Your API key stays in volatile page memory only and is never written to localStorage. Successful calls use 1 credit; failed calls charge 0.
Endpoints & Billing Overview
remove.ac exposes a production REST API 1:1 compatible with the remove.bg v1.0 contract. Existing scripts migrate by pointing to https://remove.ac/v1.0/removebg and passing X-Api-Key.
Billing uses atomic Postgres FEFO credit holds: 1 credit is captured only after inference succeeds (X-Credits-Charged: 1). Validation errors, upstream timeouts, or network failures release the hold immediately with 0 charge.
# Query remaining credits (0 credits charged)
curl -s https://remove.ac/v1.0/account \
-H "X-Api-Key: rmac_live_YOUR_API_KEY"
Authentication, Idempotency & Status Codes
Pass X-Api-Key: rmac_live_... in request headers (plaintext shown once at creation; server stores SHA-256 hashes only). Include Idempotency-Key (up to 200 chars) for safe retries without double billing; payload mismatches return HTTP 409.
Status codes: 200 binary output · 400 invalid input · 402 insufficient credits · 403 invalid/revoked key · 409 idempotency conflict/in-flight · 502 upstream error (credit hold automatically released).
Zero-Persistence Privacy Guarantee
Cloud L4 GPU workers decode and infer strictly in volatile RAM and never persist input or output image blobs in databases or idempotency caches. If your images must never leave the browser, use the free On-Device mode in the web editor.