API Keys

An API key is the credential used to access VLX FLUX APIs. Once your application includes the key in a request, the platform can identify the caller and apply authentication, billing, rate limiting, and logging.

In short: your account is for logging into the platform, while the API key is for programmatic access.

What Is an API Key Used For

• Identity: Confirm which user sends the request.
• Authorization: Determine whether the key can call a specific endpoint or model.
• Billing: Deduct balance based on request usage.
• Model Scope: Limit which models or capabilities the key can access.
• Logging: Record request time, usage, and status codes for troubleshooting.

If a request does not include a valid API key, the API usually returns an authorization error.

Management Portal

Key Dashboard

When You Need It

You will use API keys whenever you connect your project to VLX FLUX. Common cases include:

• Configure API keys in the OpenAI SDK or compatible SDKs.
• Call VLX FLUX from servers, scripts, or terminal tools.
• Assign separate credentials for different projects, team members, or environments.
• Track usage by token or business unit.

Do not hardcode your main API key in frontend code or expose it to end users.

How To Use the API Key

Most OpenAI-compatible APIs require the key in the Authorization header:

Authorization: Bearer YOUR_TOKEN

For example, a typical request includes both the API URL and the token:

curl https://api.vlxflux.io/v1/chat/completions   -H "Authorization: Bearer YOUR_TOKEN"   -H "Content-Type: application/json"   -d '{
    "model": "gpt-3.5-turbo",
    "messages": [
      { "role": "user", "content": "你好 / Hello" }
    ]
  }'

Token Limits

You can assign separate spending or usage limits to each key to reduce operational risk.

Common strategies include:

• No separate limit and use the account balance directly.
• Set a total limit so the key stops after reaching the cap.
• Set periodic limits such as daily or monthly caps.
• Limit request size or concurrency to reduce abnormal usage.

Best Practices

Create separate keys for different purposes instead of sharing one key across all projects.

Suggested names:

project-a-production
project-a-testing
team-b-bot

Benefits:

• Quickly locate request sources.
• Disable one key without affecting other projects.
• Isolate leaked keys more easily.
• Assign different budgets to different environments.

Security Notes

• Never commit keys to public repositories.
• Never paste keys into public docs, chats, or tickets.
• Never expose keys in browser-side code.
• Prefer environment variables or secret managers on the backend.
• Rotate the key immediately if you suspect leakage.

FAQ

What is the difference between an API key and account credentials?

Account credentials are for logging in, while API keys are for API calls.

How many API keys can one account create?

You can usually create multiple keys and should separate them by project, environment, or purpose.

What should I do if a key is leaked?

Disable the compromised key immediately and replace it with a new one.

Why do I still get unauthorized errors?

Common causes include an invalid key, a disabled key, no balance, missing model permissions, a wrong API URL, or an incorrect header format.