fix: keep the studio share key off redirects and explain dev links

Author: dazzatronus

README.md

@@ -84,7 +84,7 @@ shotstack status 01ja7-x8m2k-... --output json
 
 Opens a `shotstack.studio` URL that loads the Edit JSON in the browser-based editor. By default, posts the JSON to the share API and emits a short URL like `https://shotstack.studio/s/abc12345`. With an API key (`SHOTSTACK_API_KEY`, or the key saved for `--env`) the link is permanent; without one it lasts 30 days, and the command says so on stderr. A timeout, 429 or 5xx gets one retry, then the command falls back to inline base64url encoding and prints the cause. If the share API refuses the edit (too large, invalid, or an invalid key), the command exits 1 with the reason.
 
-No render API key required; no render credits charged. Use to hand a generated edit off to a human for review or quick tweaks before rendering.
+No render API key required and no render credits are charged; a key only makes the short link permanent. Use to hand a generated edit off to a human for review or quick tweaks before rendering.
 
 ```sh
 shotstack studio my-template.json

skills/shotstack/SKILL.md

@@ -123,7 +123,7 @@ shotstack generate seedance-2.0-text-to-video "Waves break over black sand at du
 
 ## Default workflow: preview in Studio (no key, no credits)
 
-**`shotstack studio <file>` is the default way to look at an edit** — prefer it over `render` unless you specifically need a cloud-exported MP4. It posts the JSON to https://shotstack.studio and opens `https://shotstack.studio/s/<slug>` in the browser — a short, shareable URL. No API key, no render credits charged; it previews client-side, so it works with no key. The human plays, edits, and decides whether to spend credits on a render.
+**`shotstack studio <file>` is the default way to look at an edit** — prefer it over `render` unless you specifically need a cloud-exported MP4. It posts the JSON to https://shotstack.studio and opens `https://shotstack.studio/s/<slug>` in the browser — a short, shareable URL. No render credits charged; it previews client-side, so it works with no key (a key only makes the short link permanent). The human plays, edits, and decides whether to spend credits on a render.
 
 ```sh
 shotstack studio template.json              # opens browser + prints short URL

src/commands/studio.ts

@@ -38,7 +38,7 @@ export const studioCommand = new Command("studio")
     }
 
     const apiKey = options.shorten ? shareApiKey(options.env) : undefined;
-    const { url, shortened } = await buildStudioUrl(template, { shorten: options.shorten, apiKey });
+    const { url, shortened } = await buildStudioUrl(template, { shorten: options.shorten, apiKey, env: options.shorten ? resolveEnvName(options.env) : undefined });
 
     if (!shortened && url.length > URL_WARN_THRESHOLD) {
       console.error(
@@ -62,15 +62,17 @@ interface StudioUrl {
 
 export async function buildStudioUrl(
   template: unknown,
-  options: { shorten?: boolean; apiKey?: string } = {}
+  options: { shorten?: boolean; apiKey?: string; env?: string } = {}
 ): Promise<StudioUrl> {
   const shouldShorten = options.shorten !== false;
   if (shouldShorten) {
     const shared = await shareViaStudio(template, options.apiKey);
     if ("url" in shared) {
       if (!options.apiKey) {
         console.error(
-          "note: this link lasts 30 days. Run `shotstack login` or set SHOTSTACK_API_KEY to make your links permanent."
+          options.env === "dev"
+            ? "note: this link lasts 30 days. Dev keys can't make links permanent; use --env stage or --env v1."
+            : "note: this link lasts 30 days. Run `shotstack login` or set SHOTSTACK_API_KEY to make your links permanent."
         );
       }
       return { url: shared.url, shortened: true };
@@ -81,11 +83,11 @@ export async function buildStudioUrl(
 }
 
 // Studio validates keys against the production and sandbox Edit API only, so a dev key would be refused.
-export function shareApiKey(cliEnv: string | undefined): string | undefined {
+export function shareApiKey(cliEnv: string | undefined, credentialsFile?: string): string | undefined {
   const env = resolveEnvName(cliEnv);
   if (env === "dev") return undefined;
   try {
-    return requireApiKey(env);
+    return requireApiKey(env, credentialsFile);
   } catch (err) {
     if (err instanceof MissingApiKeyError) return undefined;
     throw err;
@@ -114,6 +116,8 @@ async function postShare(template: unknown, headers: Record<string, string>): Pr
       method: "POST",
       headers,
       body: JSON.stringify(template),
+      // The key must never follow a redirect to another host.
+      redirect: "error",
       signal: AbortSignal.timeout(SHARE_TIMEOUT_MS),
     });
   } catch (err) {

tests/studio.test.ts

@@ -1,5 +1,8 @@
 import { describe, test, expect, beforeEach, afterEach, mock, spyOn } from "bun:test";
 import { buildInlineUrl, buildStudioUrl, shareApiKey } from "../src/commands/studio.ts";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { ApiError } from "../src/http/client.ts";
 
 const sample = {
@@ -135,6 +138,7 @@ describe("share API rules", () => {
     const result = await buildStudioUrl(sample, { apiKey: "key" });
     const headers = fetchMock.mock.calls[0]![1]!.headers as Record<string, string>;
     expect(headers["x-api-key"]).toBe("key");
+    expect(fetchMock.mock.calls[0]![1]!.redirect).toBe("error");
     expect(result.shortened).toBe(true);
     expect(stderr).not.toHaveBeenCalled();
   });
@@ -147,6 +151,12 @@ describe("share API rules", () => {
     expect(String(stderr.mock.calls[0]![0])).toContain("lasts 30 days");
   });
 
+  test("for dev, the note names the cause instead of asking for a key", async () => {
+    shareSequence(shared());
+    await buildStudioUrl(sample, { env: "dev" });
+    expect(String(stderr.mock.calls[0]![0])).toContain("Dev keys");
+  });
+
   test("retries once after a timeout", async () => {
     const fetchMock = shareSequence(timeout(), shared());
     const result = await buildStudioUrl(sample, { apiKey: "key" });
@@ -204,6 +214,16 @@ describe("shareApiKey", () => {
     expect(shareApiKey("stage")).toBe("stage-key");
   });
 
+  test("returns no key when none is set or saved", () => {
+    const dir = mkdtempSync(join(tmpdir(), "shotstack-creds-"));
+    delete process.env.SHOTSTACK_API_KEY;
+    try {
+      expect(shareApiKey("stage", join(dir, "credentials.json"))).toBeUndefined();
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   test("shares anonymously for dev because Studio cannot validate dev keys", () => {
     process.env.SHOTSTACK_API_KEY = "dev-key";
     expect(shareApiKey("dev")).toBeUndefined();