How do I authenticate requests to the Fikra API?
Fikra API relies on token-based authentication. Every API request must include your active API key in the HTTP header. Our proxy engine validates this token cryptographically before establishing any connection to the underlying model routing nodes.
Implementing the Bearer Token
Authentication to the API is performed via standard HTTP Authorization headers. You must pass your secret key using the Bearer schema. All API requests must be made over HTTPS.
Language Implementations
Key Architecture & Formats
When you generate a key in the Fikra dashboard, the system provisions a highly secure 64-character token. The raw secret is immediately hashed (SHA-256) into our database. The UI only displays the first 12 characters (the prefix) for visual identification.
| Key Prefix | Environment | Billing Impact |
|---|---|---|
| fk_live_ | Production | Deducts from your active cash wallet balance based on the model tier multiplier. |
Zero-Exposure Architecture
Your API key carries the same privileges as your master password. Because Fikra API operates on a pay-as-you-go model utilizing real funds, a compromised key can result in rapid unauthorized compute consumption.
Never expose your fk_live_ key in client-side code (e.g., vanilla React, React Native, iOS, or Android builds). Always route requests through your own secure backend proxy.
| Security Practice | Implementation Detail |
|---|---|
| Environment Variables | Store keys securely in `.env` files. Ensure `.env` is strictly added to your `.gitignore`. |
| Backend Routing | Create a secure server (FastAPI, Express, Django). Your frontend talks to your backend; your backend injects the API key and forwards the request to Fikra. |
| Key Revocation | If you suspect a leak, navigate to your Dashboard immediately to deactivate the compromised key. |
Diagnostics Checklist for 401 Unauthorized
If the API rejects your authentication attempt, our proxy server immediately terminates the connection and returns an HTTP 401 Unauthorized status. Check the following:
| Error Cause | Debugging Step |
|---|---|
| Malformed Header | Ensure there is exactly one space between the word Bearer and your API key string. |
| Trailing Whitespace | Ensure your `.env` loader is not appending hidden spaces or `\n` characters to the end of your string. |
| Revoked Key | Verify in your Fikra dashboard that the key prefix matches an active, non-deleted key. |