Authentication
Creating, using, and securing API keys.
Send your API key (prefixed sk-jf-live-) as a Bearer token on every request:
sk-jf-live-YOUR_KEY is a placeholder — swap in the real key you created in the console.
Creating & managing keys
Under Console → API Keys:
- Create: set an expiry (never / 7 / 30 / 90 days) and a quota cap (unlimited / 10 / 50 / 100 credits).
- Show-once: the full key is displayed only at creation; afterwards the list shows a mask (
sk-jf-live-…last4). If you didn't save it, delete and recreate. - Delete: a soft delete; not recoverable. To revoke a key, delete it and create a new one.
Security practices
- Do not embed keys in front-end code, public repositories, or screenshots.
- Use a separate key per purpose, each with an expiry and quota cap, to contain the blast radius of a leak.
- Suspect a leak? Delete the key immediately (a soft delete — it can't be recovered), then create a new one.
Quota & billing
Calls consume credits from your account (the same wallet as the web app). When your balance is insufficient, requests return 402 (see Errors).