---
title: "Authenticate with an API key"
description: "Authenticate Genflo API requests with an API key in the x-apikey header. The model catalog is public; creating and retrieving tasks requires a key."
---

> Documentation Index
> Fetch the complete documentation index at: https://www.genflo.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate with an API key

The model catalog is public. Creating and retrieving tasks requires an active API key. Account session tokens are not accepted by the SaaS endpoints.

## Send the key in the x-apikey header

Add the key to every request that creates or retrieves a task:

```text
x-apikey: sk-your-api-key
```

Do not send an `Authorization` header with these requests. The API reads it before `x-apikey`, so an expired or invalid token in it fails the request even when the key is valid.

## Get an API key

Sign in with Google, then create a key on the [API keys](/keys) page. All active keys share your account's credits. Revoking one key leaves the others working.

## Keep keys on your server

Anyone who holds a key can create tasks that spend your credits. Call the API from your backend and keep keys out of browser and mobile app code.

## Missing or invalid keys

A task request without a valid key returns HTTP 401:

```json
{ "detail": "Invalid API key" }
```

[Error responses](/docs/errors) lists every other error the API returns.

Source: https://www.genflo.io/docs/authentication/index.mdx