[ Developers ]API · Webhooks · MCP

Build video generation into your product

A REST API for generating, rendering and publishing short-form video, signed webhooks for every lifecycle event, and an MCP server so AI agents can drive the whole pipeline.

[ 01 ]REST API

Bearer token, JSON envelope, stable error codes

Create a key under Settings, then API & Webhooks. Keys start with sf_live_ and are scoped to a single workspace.

First request
curl https://app.shortfast.com/api/v1/ \
  -H "Authorization: Bearer sf_live_xxxxxxxxxxxxxxxxxxxxxxxx"

Every response is wrapped in a data key. List endpoints add a paging object, where limit runs from 1 to 100 and defaults to 50.

Response shape
{
  "data": { ... },
  "paging": { "limit": 50, "offset": 0 }
}

Errors carry a machine-readable code that is stable across releases, so you can branch on it instead of parsing messages.

Error shape
{
  "status": 401,
  "code": "unauthorized",
  "message": "..."
}

POST requests accept an Idempotency-Key header, so a retry after a timeout cannot double-charge or duplicate an action.

[ 02 ]The core loop

Brief in, published video out

The shape of nearly every integration is the same. Queue a generation from a brief, wait for it, render the mp4, then publish the result or hand back a download URL.

Both generation and rendering are asynchronous. The response returns immediately with a queued status, and you either poll until it reports COMPLETED or FAILED, or subscribe to webhooks and skip the polling entirely. Webhooks are the better choice for anything running in production.

Automations wrap that loop in a schedule: one brief becomes a blueprint that regenerates a fresh clip and publishes it on a recurring cadence, with a readiness checklist telling you what is still missing before it can activate.

[ 03 ]Webhooks

Signed, at-least-once, every lifecycle event

video.createdvideo.generation_completedvideo.generation_failedvideo.render_completedvideo.render_failedvideo.scheduledvideo.publishedvideo.publish_failedautomation.clip_createdautomation.blockedautomation.stopped

Each delivery is signed with X-ShortFast-Signature, an HMAC-SHA256 hex digest of the raw request body. Verify against the raw body before parsing it, and compare in constant time.

Verifying a delivery (Node)
const crypto = require('crypto');

const signature = req.get('X-ShortFast-Signature') || '';
const expected = crypto
  .createHmac('sha256', process.env.SHORTFAST_WEBHOOK_SECRET)
  .update(req.body)
  .digest('hex');

const valid =
  signature.length === expected.length &&
  crypto.timingSafeEqual(Buffer.from(signature, 'hex'), Buffer.from(expected, 'hex'));

Delivery is at-least-once, so deduplicate on X-ShortFast-Delivery. Acknowledge with any 2xx within 8 seconds; slower than that and it counts as a failure. Retries back off at roughly 4s, 16s, 64s, 4 minutes and 17 minutes, up to 6 attempts, and an endpoint that fails 25 times consecutively disables itself. Delivery logs are kept for 7 days.

[ 04 ]MCP

The same surface, for AI agents

The MCP server exposes the same operations over the Model Context Protocol, with tools that mirror the REST endpoints one to one. Claude, ChatGPT, n8n and Make connect by pasting a single URL, with no package to install and nothing to host.

Connection URL
https://app.shortfast.com/mcp?key=sf_mcp_xxxxxxxxxxxxxxxxxxxxxxxx
[ 05 ]Documentation

Straight to the reference

Full guides and a live API reference live on developer.shortfast.com.

[ 06 ]FAQ

Common questions

What can the ShortFast API do?
Generate a video from a brief, render it to an mp4, download it, publish it to connected social accounts, and run automations that produce a fresh clip on a schedule. It also exposes the editor, so you can read and change a video's transcript, captions, b-roll segments and scenes.
How do I authenticate?
With a bearer token created in Settings then API & Webhooks in the ShortFast app. Keys start with sf_live_ and are scoped to a workspace. Send it as an Authorization header on every request.
Is generation synchronous?
No. Generation and rendering are queued, so the response comes back immediately with a queued status. Either poll the job until it reports COMPLETED or FAILED, or subscribe to the webhook events and let ShortFast tell you.
How do I avoid double-charging on a retry?
Send an Idempotency-Key header on POST requests. Retrying with the same key will not duplicate the action or the charge, and a retry that arrives while the first is still running returns idempotency_in_progress with a 409.
How are webhooks secured?
Every delivery carries an X-ShortFast-Signature header, which is the HMAC-SHA256 hex of the raw request body keyed by the endpoint's signing secret. Verify it against the raw body before parsing the JSON, and compare in constant time.
What happens if my endpoint is down?
Delivery is at-least-once with exponential backoff, retrying at roughly 4s, 16s, 64s, 4 minutes and 17 minutes for up to 6 attempts. After 25 consecutive failures the endpoint disables itself. Deduplicate on the X-ShortFast-Delivery header, since a retry can arrive after you already processed the first copy.
Should I use the API or the MCP server?
The REST API is for code you write and deploy. The MCP server is for an AI assistant or an automation platform that discovers tools at runtime. They cover the same surface, so a common pattern is prototyping a flow over MCP and shipping it over the API.
Does API usage cost the same as using the app?
Yes. Generation, rendering and publishing draw on the same workspace credits and the same plan limits regardless of whether the call came from the app, the API or MCP. A call that would exceed your credits is refused with warning-no-credits rather than partially completing.

Get an API key

Keys live under Settings, then API & Webhooks. The docs walk you from a first request to a scheduled automation.