Szum Authentication

Anonymous use, API keys, MCP OAuth, and authentication for publishing charts from the web editor or Figma.

Some features on this page require a paid plan. See Plans & Limits.

You can explore Szum without an account. Authentication becomes necessary when you exceed the anonymous image allowance, save or publish a chart, or use account-level features.

At a glance

Workflow	Start without authentication	Authentication when needed
AI agents	Connect, inspect, validate, and preview interactively	OAuth or API key to save or use account-backed rendering
Web editor	Edit and export with built-in themes	Account session to publish; Creator, Pro, or Team for theme overrides
Image API	Keyless `GET /chart`	API key for `POST /chart` and account limits
Figma	Create and insert locally	API key to publish and use account plan features

Keyless GET /chart allows 100 image renders per month per IP. Temporary image URLs from anonymous render_chart calls have a separate allowance of 250 renders per month, counted against the IP that called the tool. The interactive guest preview itself is free and counts against neither. No signup is needed.

https://szum.io/chart?config=%7B%22version%22%3A%222026-09-26%22%2C%22config%22%3A%7B%22version%22%3A%222026-09-26%22%2C%22type%22%3A%22column%22%2C%22category%22%3A%7B%22field%22%3A%22quarter%22%7D%2C%22values%22%3A%7B%22type%22%3A%22long%22%2C%22field%22%3A%22revenue%22%7D%7D%2C%22data%22%3A%5B%7B%22quarter%22%3A%22Q1%22%2C%22revenue%22%3A42%7D%2C%7B%22quarter%22%3A%22Q2%22%2C%22revenue%22%3A58%7D%5D%2C%22output%22%3A%7B%22format%22%3A%22svg%22%7D%7D

The config parameter holds the complete, percent-encoded document.

Account sessions

Sign in on szum.io to save editor drafts, publish charts, manage them in Studio, create API keys under Connect, and manage billing under Account.

Publishing from the web editor uses your signed-in session. It creates stable image, embed, and share-page URLs without exposing credentials in those public URLs.

API keys

Create and manage keys under Connect → API. Keys follow this format:

sz_live_...

Use a key with the TypeScript SDK:

import { writeFile } from "node:fs/promises";

import { Szum, type ChartDocument } from "@szum-io/sdk";

const request = {
  "config": {
    "type": "column",
    "category": {
      "field": "quarter"
    },
    "values": {
      "type": "long",
      "field": "revenue"
    }
  },
  "data": [
    {
      "quarter": "Q1",
      "revenue": 42
    },
    {
      "quarter": "Q2",
      "revenue": 58
    }
  ],
  "output": {
    "format": "svg"
  }
} satisfies ChartDocument;

const apiKey = process.env.SZUM_API_KEY;

if (!apiKey) {
  throw new Error("SZUM_API_KEY is required");
}

const szum = new Szum({ apiKey });
const image = await szum.render(request);
await writeFile("chart.svg", image);

Or pass it to raw HTTP requests:

curl 'https://szum.io/chart' \
  --fail \
  --max-time 30 \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
  "version": "2026-09-26",
  "config": {
    "version": "2026-09-26",
    "type": "column",
    "category": { "field": "quarter" },
    "values": { "type": "long", "field": "revenue" }
  },
  "data": [
    { "quarter": "Q1", "revenue": 42 },
    { "quarter": "Q2", "revenue": 58 }
  ],
  "output": { "format": "svg" }
}' \
  --output 'chart.svg'

The Figma plugin also accepts an API key in its settings for publishing and plan-aware features. Keys are credentials: never put one in an image URL, iframe, client bundle, or public repository. Rotate a compromised key under Connect → API.

MCP OAuth

OAuth is the preferred method for MCP clients that support it: the client opens a browser window, you sign in to Szum, and the client gets scoped access without you pasting an API key into its configuration.

Clients without OAuth support can send an API key as Authorization: Bearer YOUR_API_KEY. See the MCP setup guide for client-specific configuration.

Saved and published charts

Saved charts can be created through the MCP server, web editor, API, or Figma plugin. Authentication is required to create, update, list, or delete them. Their published /c/{id}, /e/{id}, and /v/{id} URLs are public capabilities and do not contain your credentials.

See Saved charts for the lifecycle and endpoint reference.

Limits

Anonymous image and API routes are limited to 10 requests per second per IP. The MCP endpoint has a separate 100 requests-per-second limit per IP; authenticated MCP calls also use the 30 requests-per-second credential limit. Monthly render allowances reset on the first day of each month in UTC.

See Plans & Limits for included usage and paid features.

Authentication