Shotstack
DESIGN · FILES & DOCS
Video, image and audio renders, templates, and hosted assets on their own key.
Connecting Shotstack in practice
Shotstack separates sandbox from production by one path segment on the same host — /edit/stage against /edit/v1 — so a single wrong constant sends real renders through billing, and the sandbox still needs at least one credit before it will work at all. Rate limits are per API key in a fixed 60-second window and identical on every plan: 300 Edit, 600 Serve and 300 Ingest requests in production.
Scopes that draw scrutiny
Production API key (x-api-key)A random 40-character string. Using it consumes credits and can result in charges, and there is no scope narrowing — the same key renders, serves and ingests.Sandbox (staging) API keyThe same reach against /edit/stage. Videos come out watermarked and renders are capped at 10 minutes, but AI assets are still charged, so the sandbox is not free.
Rate limits
- Per API key, fixed 60-second window, identical on all plans. Production: Edit 300, Serve 600, Ingest 300 requests per 60 seconds.
- Sandbox per 60 seconds: Edit 150, Serve 300, Ingest 120.
- Roughly 5 requests per second for most APIs in production.
- Exceeding a limit returns HTTP 429 with an error of type rate_limit_error; wait for the current window to reset before retrying with exponential backoff.
- Rendering takes roughly 20 seconds per minute of output video, before effects, filters and transitions.
- Individual source files are capped at 5 GB, and source footage plus output must not exceed 10 GB in total.
Worth knowing
- The sandbox shares the host with production and differs only in the path, so environment selection is a string that looks like a typo rather than a separate base URL or key prefix.
- Sandbox renders are capped at 10 minutes of output and always watermarked, so output length and appearance cannot be validated there.
- You need at least one credit for the sandbox to function, and AI asset generation is billed in the sandbox too — testing is not cost-free.
- The retry advice is unusually strict: because the window is fixed rather than rolling, the docs say not to resubmit immediately and to wait for the 60-second window to reset.
Checked against Limitations (2026-09-29), Request API keys (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Shotstack behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.