GET /v1/account

The account behind the key you are using, plus the secret Galley signs webhook bodies with. Free, and safe to call at startup.

GET https://api.galleyrender.com/v1/account
Authorization: Bearer glr_sk_…

Takes no parameters.

Response

Read the account shell

curl -sS https://api.galleyrender.com/v1/account \
  -H "Authorization: Bearer $GALLEY_API_KEY"

Read the account javascript

// Node 22+. No dependencies — `fetch` is built in.
const res = await fetch("https://api.galleyrender.com/v1/account", {
  headers: {
    authorization: `Bearer ${process.env.GALLEY_API_KEY}`,
  },
});

const account = await res.json();
if (!res.ok) throw new Error(account.error.message);

console.log(account);

Read the account python

# Python 3.9+. Standard library only.
import json, os, urllib.request

req = urllib.request.Request(
    "https://api.galleyrender.com/v1/account",
    headers={"Authorization": f"Bearer {os.environ['GALLEY_API_KEY']}"},
)

account = json.load(urllib.request.urlopen(req))
print(account)

{
  "object": "account",
  "id": "acct_9k2pv3n8rc4t",
  "name": "Acme Robotics",
  "email": "ops@acme.example",
  "plan": "starter",
  "status": "active",
  "verified": true,
  "trial": false,
  "webhook_secret": "whsec_kQ9xFbR2v7nJ4pLmW8sT1yZcH6dA3gQeU5oX0iN2rV",
  "webhook_secret_prefix": "whsec_kQ9x…",
  "webhook_secret_shown_at": "2026-09-16T14:02:11.004Z",
  "webhook_signature_header": "X-Galley-Signature",
  "webhook_signature_scheme": "sha256=<hex hmac-sha256 of the raw request body>",
  "rate_limit": {
    "renders_per_minute": 600,
    "window_seconds": 60,
    "scope": "api_key"
  },
  "limits": {
    "free_renders_per_month": 200,
    "monthly_spend_cap_usd": 50
  }
}

Field	Type	Description
`id`	string	`acct_…`. Stable. Quote it in a support mail.
`email`	string \| null	`null` until the address is verified.
`plan`	string	`free`, `payg`, `starter`, `growth` or `scale`.
`status`	string	`active`, or `suspended` — a suspended account renders nothing.
`trial`	boolean	True on a keyless trial account. See `GET /v1/usage` for what is left of it.
`webhook_secret`	string \| null	The signing secret — shown once. `null` on every later call.
`webhook_secret_prefix`	string	Enough to tell which secret you stored, not enough to forge with.
`webhook_signature_header`	string	Always `X-Galley-Signature`.
`rate_limit`	object	Renders per minute this account’s keys may start, and the window. See `rate_limited`.
`limits`	object	The account’s free allowance and monthly spend cap.

The secret is shown once

{
  "object": "account",
  "id": "acct_9k2pv3n8rc4t",
  "webhook_secret": null,
  "webhook_secret_prefix": "whsec_kQ9x…",
  "webhook_secret_shown_at": "2026-09-16T14:02:11.004Z",
  "note": "The webhook secret is shown once. If you no longer have it, POST /v1/account/webhook-secret to rotate — that invalidates the old one, so update your handler at the same time."
}

POST /v1/account/webhook-secret

Mints a new secret and returns it once. The old secret stops verifying immediately, so a handler that has not been updated will start rejecting real deliveries — which Galley then retries, five times over about a quarter of an hour. That is usually enough room to deploy the new secret, but do it the other way round if you can: deploy a handler that accepts either, then rotate, then drop the old one.

curl -sS -X POST https://api.galleyrender.com/v1/account/webhook-secret \
  -H "Authorization: Bearer $GALLEY_API_KEY"

{
  "object": "webhook_secret",
  "account": "acct_9k2pv3n8rc4t",
  "webhook_secret": "whsec_3pL8xQ2vN9tR5mK7wJ1yB4cF6dH0aG2eU8oZ5iX3rS",
  "webhook_secret_prefix": "whsec_3pL8…",
  "rotated_at": "2026-09-20T09:14:33.881Z",
  "note": "Shown once. The previous secret no longer verifies any delivery."
}

Errors

Type	Status	When
`authentication_error`	401	The key is missing, malformed or revoked.