Authenticate with an API key

Authenticate Genflo API requests with an API key in the x-apikey header. The model catalog is public; creating and retrieving tasks requires a key.

The model catalog is public. Creating and retrieving tasks requires an active API key. Account session tokens are not accepted by the SaaS endpoints.

Send the key in the x-apikey header

Add the key to every request that creates or retrieves a task:

x-apikey: sk-your-api-key

Do not send an Authorization header with these requests. The API reads it before x-apikey, so an expired or invalid token in it fails the request even when the key is valid.

Get an API key

Sign in with Google, then create a key on the API keys page. All active keys share your account’s credits. Revoking one key leaves the others working.

Keep keys on your server

Anyone who holds a key can create tasks that spend your credits. Call the API from your backend and keep keys out of browser and mobile app code.

Missing or invalid keys

A task request without a valid key returns HTTP 401:

{ "detail": "Invalid API key" }

Error responses lists every other error the API returns.