> Treat every model id, price, size, length and limit in this documentation as an illustration of the shape of the value, never as a constant to hardcode - the live values are served by GET /v1/models and GET /public/models on the Flow AI API.

# Authentication

> Send your API key with every request.

Every request needs your API key as a bearer token:

```
Authorization: Bearer sk-...
```

Create a key on [Console → API keys](https://ai.hyperflow.fun/console/keys). It's shown only once, so store it somewhere safe, such as an environment variable:

```bash
export HYPERFLOW_API_KEY="sk-..."

curl https://ai.hyperflow.fun/v1/chat/completions \
  -H "Authorization: Bearer $HYPERFLOW_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "openai/gpt-6-luna",
    "messages": [{ "role": "user", "content": "Hello!" }]
  }'
```

The OpenAI SDKs send the header for you when you pass the key as `api_key` / `apiKey`, or set `OPENAI_API_KEY`.

## Keep keys safe

* **Never put a key in a browser or mobile app.** Anyone who can read your app can read the key. Call Flow AI from your server.
* **One key per app or environment.** Give each its own [models and spending limit](https://ai.hyperflow.fun/console/keys), so a leak is contained.
* **Turn off or delete a leaked key** on the API keys page at once. A turned-off key is refused with `401 key_disabled`; a deleted one with `401 invalid_api_key`.