Skip to content
GFlow4AI
VIGet for Windows
Guide/Connect AI agents

Create and protect API keys

Updated 2026-11-04Try the web sample

Use a separate scoped key and daily budget for each local client.

API keys list
API keys list · Real app screen with web sample data · App labels are currently in Vietnamese

Before you start

  • Open Settings → API & agent in the Windows app.

Steps

  1. Create a recognisable key

    In “Khoá API”, choose “Tạo khoá”. Give each application a distinct name so you can identify and revoke it independently. A key is fsk_ followed by 32 letters or digits; the app stores a SHA-256 hash, not the full secret.

  2. Select only necessary scopes

    • read: status, models, job reading and output download.
    • generate: reference uploads, generation and cancellation.
    • characters: character creation and updates.

    Job reading and file access are restricted to the key’s own resources; characters are shared across the app. A generation workflow that monitors results also needs read.

  3. Set the daily budget

    Choose a whole-number credit cap from 0 to 100,000. 0 means no cap, not zero spending. Admission includes today’s submitted credits and estimates held by queued/running jobs, so the displayed spent amount alone may not explain a rejection. See credits and cost.

  4. Save the secret once and authenticate

    Copy the full key before closing its reveal dialog. The list later shows only a masked prefix. Use it in the Authorization header, never a URL or public repository. Test GET /v1/status with Authorization: Bearer <your local API key>.

  5. Revoke instead of sharing or recovering

    Use “Thu hồi” for a lost or exposed key, then create a replacement and update the client. A revoked key is no longer accepted. Do not expect a new key to access jobs owned by the old key.

When it worked

The key is listed with the intended scopes and cap, and an authenticated status call succeeds.

If something goes wrong

Can I show the full key again?

No. Create a replacement and revoke the lost key.

Why do I get 401 or 403?

401 means missing, invalid or revoked credentials. 403 forbidden means the key lacks a required scope; create a key with the necessary permissions. A request carrying Origin is separately rejected.