Authentication

Every request needs your API key as a bearer token:

Authorization: Bearer sk-...

Create a key on Console → API keys. It’s shown only once, so store it somewhere safe, such as an environment variable:

export HYPERFLOW_API_KEY="sk-..."
curl https://ai.hyperflow.fun/v1/chat/completions \
  -H "Authorization: Bearer $HYPERFLOW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "openai/gpt-6-luna",
    "messages": [{ "role": "user", "content": "Hello!" }]
  }'

The OpenAI SDKs send the header for you when you pass the key as api_key / apiKey, or set OPENAI_API_KEY.

Keep keys safe

• Never put a key in a browser or mobile app. Anyone who can read your app can read the key. Call Flow AI from your server.
• One key per app or environment. Give each its own models and spending limit, so a leak is contained.
• Turn off or delete a leaked key on the API keys page at once. A turned-off key is refused with 401 key_disabled; a deleted one with 401 invalid_api_key.