Init API Reference

`GET /api/v1/editor/init`

The init endpoint is called by the ReadyEditor loader on every page load. It authenticates your API key, verifies the requesting domain is allowed, and returns the feature set and asset URLs for your plan.

You do not normally need to call this endpoint directly — the loader handles it. This reference is useful if you are building a custom loader integration or debugging authentication failures.

Request

GET https://<your-readyeditor-host>/api/v1/editor/init

Query parameters

Parameter	Type	Required	Description
`apiKey`	string	Yes	Your project API key (starts with `rk_`)
`origin`	string	No	The origin of the embedding page (e.g. `https://example.com`). The loader sends this automatically.
`sdkVersion`	string	No	Loader version string. Echoed back in the response for debugging.

Example request

GET /api/v1/editor/init?apiKey=rk_live_abc123&origin=https%3A%2F%2Fexample.com

CORS

The endpoint returns appropriate Access-Control-Allow-Origin headers for domains registered in your project. Cross-origin preflight (OPTIONS) requests are handled automatically.

Success response

HTTP 200 OK

{
  "ok": true,
  "plan": "pro",
  "features": [
    "clipboard",
    "formatting_basic",
    "formatting_blocks",
    "lists",
    "colors",
    "lineheight",
    "align",
    "link",
    "media",
    "table",
    "findreplace",
    "view_source",
    "view_fullscreen",
    "tools_emoji",
    "wordcount",
    "formatting_misc",
    "bootstrap",
    "embed_video",
    "icons",
    "image_tools",
    "readability",
    "attrs",
    "shortcuts_help"
  ],
  "domain": "example.com",
  "language": "en",
  "releaseVersion": "0.0.35",
  "releaseBase": "https://cdn.readyeditor.io/releases/0.0.35",
  "assets": {
    "css": [
      {
        "path": "css/editor.dev.css",
        "url": "https://cdn.readyeditor.io/releases/0.0.35/css/editor.dev.css",
        "integrity": "sha256-..."
      },
      {
        "path": "css/readyeditor.ui.dev.css",
        "url": "https://cdn.readyeditor.io/releases/0.0.35/css/readyeditor.ui.dev.css",
        "integrity": "sha256-..."
      }
    ],
    "js": {
      "core": [
        {
          "path": "js/editor.dev.min.js",
          "url": "https://cdn.readyeditor.io/releases/0.0.35/js/editor.dev.min.js",
          "integrity": "sha256-..."
        },
        {
          "path": "js/ui.core.min.js",
          "url": "https://cdn.readyeditor.io/releases/0.0.35/js/ui.core.min.js",
          "integrity": "sha256-..."
        }
      ],
      "plugins": [
        {
          "name": "formatting_basic",
          "path": "js/plugins/plugin.formatting.basic.min.js",
          "url": "https://cdn.readyeditor.io/releases/0.0.35/js/plugins/plugin.formatting.basic.min.js",
          "integrity": "sha256-..."
        }
      ]
    }
  },
  "sdkVersion": "0.0.35",
  "ts": 1744588800
}

Response fields

Field	Type	Description
`ok`	boolean	`true` on success
`plan`	string	The active plan key (`basic`, `pro`, `dev`)
`features`	string[]	Plugin names enabled for this project
`domain`	string	Detected domain from the request
`language`	string	Editor language (currently `"en"`)
`releaseVersion`	string	The pinned release version for this workspace
`releaseBase`	string	Base URL for all release assets
`assets`	object	Pre-resolved asset URLs with optional SRI hashes (see below)
`assets.css`	array	CSS files to load
`assets.js.core`	array	Core JS files to load
`assets.js.plugins`	array	Plugin JS files to load (filtered to `features`)
`sdkVersion`	string	Echoed `sdkVersion` query param
`ts`	number	Unix timestamp (rounded to the minute)

Each asset entry has:

Field	Type	Description
`path`	string	Relative path within the release
`url`	string	Absolute URL
`integrity`	string \| null	SRI hash (`sha256-...`), or `null` if not available

Error responses

All error responses return HTTP 200 with ok: false. The loader treats these as soft failures and will not initialize the editor.

Missing API key

{
  "ok": false,
  "error": "missing_api_key",
  "plan": null,
  "features": [],
  "language": "en"
}

Invalid API key

{
  "ok": false,
  "error": "invalid_api_key",
  "plan": null,
  "features": [],
  "language": "en"
}

Domain not allowed

Returned when the requesting domain is not in your project's allowed domains list.

{
  "ok": false,
  "error": "domain_not_allowed",
  "domain": "unauthorized.com",
  "plan": null,
  "features": [],
  "language": "en"
}

Fix: Add the domain to your project in the dashboard, or check that data-init-endpoint in your loader tag is correctly resolving against the CDN origin (not the host page origin).

Project inactive

{
  "ok": false,
  "error": "project_inactive",
  "plan": null,
  "features": [],
  "language": "en"
}

Subscription blocked

Returned when the workspace subscription is canceled or unpaid (and any grace period has expired).

{
  "ok": false,
  "error": "subscription_blocked",
  "plan": null,
  "features": [],
  "language": "en"
}

Caching

The response includes caching headers that allow CDN/reverse proxies to cache successful responses briefly (s-maxage=60, stale-while-revalidate=300). Browser-side revalidation is always required (max-age=0, must-revalidate). Conditional requests using ETag / If-None-Match are supported.

Testing the endpoint

# Valid request
curl "https://<your-host>/api/v1/editor/init?apiKey=rk_live_abc123&origin=https%3A%2F%2Fexample.com"

# Missing API key
curl "https://<your-host>/api/v1/editor/init"

# Invalid API key
curl "https://<your-host>/api/v1/editor/init?apiKey=invalid"