Build with the QikTools API

curl -X POST https://www.qiktools.com/api/v1/generate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "capability": "text-to-image",
    "prompt": "a serene mountain lake at sunrise",
    "engine": "flash",
    "resolution": "2K",
    "aspectRatio": "16:9"
  }'

Response — 200 OK

{
  "success": true,
  "imageUrl": "https://…/image.png",
  "creditsCharged": 6,
  "settings": { "engine": "flash", "resolution": "2K", "aspectRatio": "16:9" }
}

curl https://www.qiktools.com/api/v1/account \
  -H "Authorization: Bearer YOUR_API_KEY"

Response — 200 OK

{
  "plan": "studio",
  "credits": 1840,                 // the wallet requests are charged to
  "credits_source": "personal",    // "team" when that wallet belongs to your team
  "on_team": false
}

curl -X POST https://www.qiktools.com/api/v1/generate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "capability": "product-commercial",
    "productImageUrl": "https://example.com/product.png",
    "visualPrompt": "The bottle turns slowly on a marble counter in soft morning light",
    "voiceoverScript": "Meet the bottle that keeps your water cold all day.",
    "engine": "seedance",
    "durationSeconds": 8,
    "resolution": "720p",
    "aspectRatio": "9:16",
    "webhook_url": "https://your-app.example.com/qiktools-webhook",
    "webhook_secret": "a-long-random-string-you-choose"
  }'

Response — 202 Accepted

{
  "job_id": "5b6f0d9c-…",
  "status": "processing",
  "capability": "product-commercial",
  "credits_charged": 207,
  "settings": { "engine": "seedance", "durationSeconds": 8, "resolution": "720p", "aspectRatio": "9:16" },
  "poll_url": "/api/v1/jobs/5b6f0d9c-…"
}

curl https://www.qiktools.com/api/v1/jobs/JOB_ID \
  -H "Authorization: Bearer YOUR_API_KEY"

Job — 200 OK

{
  "job_id": "5b6f0d9c-…",
  "status": "succeeded",                 // "processing" | "succeeded" | "failed"
  "capability": "product-commercial",
  "result": { "video_url": "https://…/video.mp4", "has_voice": true },
  "error": null,                         // a message when status is "failed"
  "credits_charged": 207,                // 0 for a refunded failure; the kept credits for a provider_safety_charged refusal
  "created_at": "2026-09-25T12:00:00Z",
  "completed_at": "2026-09-25T12:03:41Z",
  "webhook": { "state": "delivered", "attempts": 1 }   // null if you gave no webhook_url
}

Body

{
  "id": "delivery id",
  "event": "job.succeeded",              // or "job.failed"
  "created": 1767225600,
  "data": {
    "job_id": "5b6f0d9c-…",
    "status": "succeeded",               // or "failed" (with an "error" message)
    "capability": "product-commercial",
    "credits_charged": 207,
    "result": { "video_url": "https://…/video.mp4", "has_voice": true }
  }
}

import crypto from "node:crypto";

// Verify against the RAW request body, exactly as received (before any JSON parsing).
export function verifyQiktoolsWebhook(rawBody, signatureHeader, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(signatureHeader.split(",").map((part) => part.split("=")));
  if (!parts.t || !parts.v1) return false;

  // Reject old deliveries so a captured request can't be replayed later.
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > toleranceSeconds) return false;

  const expected = crypto.createHmac("sha256", secret).update(parts.t + "." + rawBody).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(parts.v1);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Express example — use the raw body for this route:
// app.post("/qiktools-webhook", express.raw({ type: "application/json" }), (req, res) => {
//   const ok = verifyQiktoolsWebhook(req.body.toString("utf8"), req.get("X-Qiktools-Signature") ?? "", process.env.QIKTOOLS_WEBHOOK_SECRET);
//   if (!ok) return res.sendStatus(400);
//   const event = JSON.parse(req.body.toString("utf8"));
//   // ...handle event.event ("job.succeeded" / "job.failed"), then:
//   res.sendStatus(200);
// });

# One key per generation (here a UUID). Retrying with the SAME key and body is always safe.
curl -X POST https://www.qiktools.com/api/v1/generate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 0f8c7e52-4c1b-4c8e-9a51-6d2f0b7a91c3" \
  -d '{ "capability": "text-to-image", "prompt": "a serene mountain lake at sunrise", "engine": "flash" }'