Authentication

All API requests require a valid API key. The key is sent as an HTTP header with every request.

How keys work

Generate a key from your panel at /token. Each key has a descriptive name so you can identify it.

The key is only shown ONCE at creation time. After that, it is only stored as a hash.

Include the key in every request using the Authorization or x-api-key header.

Header formats

The API accepts either format. Use whichever works best with your SDK or tooling.

Authorization (Bearer)

Recommended

The standard format compatible with the OpenAI SDK and most tools.

bash

curl https://api.ai.tryflama.com/v1/chat/completions \
  -H "Authorization: Bearer tf_sk_abc123def456" \
  -H "Content-Type: application/json" \
  -d '{"model":"qwen3.8-max","messages":[{"role":"user","content":"Hi"}]}'

x-api-key

Alternative format compatible with Anthropic SDKs.

bash

curl https://api.ai.tryflama.com/v1/chat/completions \
  -H "x-api-key: tf_sk_abc123def456" \
  -H "Content-Type: application/json" \
  -d '{"model":"qwen3.8-max","messages":[{"role":"user","content":"Hi"}]}'

Using with SDKs

If you use the OpenAI SDK, you only need to change the base_url. The SDK handles the header automatically.

python

import openai

client = openai.OpenAI(
    base_url="https://api.ai.tryflama.com/v1",
    api_key="tf_sk_abc123def456"
)

# The SDK handles the Authorization header automatically
response = client.chat.completions.create(
    model="qwen3.8-max",
    messages=[{"role": "user", "content": "Hi"}]
)

Security best practices

Never expose your API key in client-side code, public repositories, or browser requests.

Use environment variables to store your key (e.g., process.env.AI_API_KEY).

Rotate keys regularly. You can revoke a key at any time from /token.

If you suspect a key has been compromised, revoke it immediately and generate a new one.

Revoking keys

You can revoke any key from your panel at /token. A revoked key stops working immediately. There is no way to recover a revoked key.