Szum Authentication

Anonymous use, API keys, MCP OAuth, and authentication for publishing charts from the web editor or Figma.

Some features on this page require a paid plan. See Plans & Limits.

You can explore Szum without an account. Authentication becomes necessary when you exceed the anonymous image allowance, save or publish a chart, or use account-level features.

At a glance

Workflow	Start without authentication	Authentication when needed
AI agents	Connect, inspect, validate, and preview interactively	OAuth or API key to save or use account-backed rendering
Web editor	Edit and export with built-in themes	Account session to publish; Creator for custom themes
Image API	Keyless `GET /chart`	API key for `POST /chart` and account limits
Figma	Create and insert locally	API key to publish and use account plan features

Keyless GET /chart has an allowance of 100 image renders per month per IP. Temporary image URLs returned by anonymous render_chart calls use a separate allowance of 250 renders per month against the tool caller's originating IP. The interactive guest preview is a complimentary render and does not consume either allowance. No signup is required.

https://szum.io/chart?config={"version":"2026-03-20","format":"svg","marks":[{"type":"barY","data":[{"x":"Q1","y":42}]}]}

GET configs must be percent-encoded in production. They are shown unencoded here for readability.

Account sessions

Sign in on szum.io to save editor drafts, publish charts, manage them in Studio, and access billing and API-key settings.

Publishing from the web editor uses your signed-in session. It creates stable image, embed, and share-page URLs without exposing credentials in those public URLs.

API keys

Create and manage keys under Account → API keys. Keys follow this format:

sz_live_...

Use a key with the TypeScript SDK:

import { Szum } from "@szum-io/sdk";

const szum = new Szum({ apiKey: "YOUR_API_KEY" });
const svg = await szum.render({ format: "svg", marks: [...] });

Or pass it to raw HTTP requests:

curl -X POST https://szum.io/chart \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"version":"2026-03-20","format":"svg","marks":[{"type":"barY","data":[{"x":"Q1","y":42}]}]}'

The Figma plugin also accepts an API key in its settings for publishing and plan-aware features. Keys are credentials: never put one in an image URL, iframe, client bundle, or public repository. Rotate a compromised key from the account page.

MCP OAuth

OAuth is the preferred authentication method for MCP clients that support it. The client opens a browser flow, you sign in to Szum, and the client receives scoped access without asking you to paste an API key into its configuration.

Clients without OAuth support can send an API key as Authorization: Bearer YOUR_API_KEY. See the MCP setup guide for client-specific configuration.

Saved and published charts

Saved charts can be created through the MCP server, web editor, API, or Figma plugin. Authentication is required to create, update, list, or delete them. Their published /c/{id}, /e/{id}, and /v/{id} URLs are public capabilities and do not contain your credentials.

See Saved charts for the lifecycle and endpoint reference.

Limits

Anonymous image and API routes are limited to 10 requests per second per IP. The MCP endpoint has a separate 100 requests-per-second limit per IP; authenticated MCP calls also use the 30 requests-per-second credential limit. Monthly render allowances reset on the first day of each month in UTC.

See Plans & Limits for included usage and paid features.

Authentication