Except for key management, which is restricted to the console session, authenticated routes accept an API key in the HTTP Authorization header.
A new key is displayed only once. Store it in a secret manager and never send it in a URL or request body.
Check the key and balance
available subtracts estimates for every generation that has not been settled yet. Use it to determine whether a new generation can be accepted.
Manage keys
The Fanify console lets you create, list, and revoke keys. The /api/v1/hub/keys routes require the console session cookie and the X-Requested-With: XMLHttpRequest header. They reject Bearer authentication.
A revoked key returns 401 unauthorized. See the error reference.