Getting started
API keys and authentication
Every request carries one of your keys. Give each app, agent or teammate its own, with its own limits, so you can stop one without touching the rest.
Sending your key#
Both header styles are accepted on every endpoint, so OpenAI-style and Anthropic-style clients work unchanged.
| Header | Used by |
|---|---|
Authorization: Bearer fs_live_… | OpenAI SDKs and tools, Claude Code with ANTHROPIC_AUTH_TOKEN |
x-api-key: fs_live_… | Anthropic SDKs, Claude Code with ANTHROPIC_API_KEY |
curl https://fullsendai.com/v1/models -H "Authorization: Bearer $FULLSEND_API_KEY"A missing, unknown or revoked key gets 401 invalid_api_key. See Errors for the rest.
Creating keys#
Create keys on API keys. Each key starts with fs_live_, belongs to one project (your default project unless you pick another), and is shown in full only once: we store a hash of it, so we can't show it again. If you lose one, revoke it and create another.
Per-key limits and locks#
Each key can carry any of these. All are checked live on every request, so a change takes effect on the next call.
| Setting | What it does | When it's hit |
|---|---|---|
| Monthly spend cap | Stops the key once it has spent this much in the calendar month (UTC). Your other keys keep working. | 429 key_limit_reached |
| Requests per minute | Replaces the model's default rate for this key, on each model. See Rate limits. | 429 rate_limit_exceeded |
| Allowed models | Only these model IDs can be called. GET /v1/models lists only them. | 403 model_not_allowed |
| Allowed IP addresses | Only requests from these addresses or CIDR ranges (IPv4 or IPv6, up to 50) are accepted, like 203.0.113.0/24. | 403 ip_not_allowed |
| Expiry date | The key stops working at this time. We email you before it does. | 401 key_expired |
Rotating and revoking#
- Rotate swaps a key for a new one with the same name, project, limits and locks. The old key keeps working for 1 hour, 24 hours or 7 days while you roll out the new one, or stops at once.
- Revoke stops a key on its next request. Revoked the wrong one? Undo brings it back within 15 minutes.
- When someone leaves your team, every key they created on it is revoked.
Keeping keys safe#
- Keep keys in environment variables or a secrets manager, never in a public repository or a mobile or browser app that ships to users. Call FullsendAI from your server.
- Give each agent, CI job or shared machine its own key with a monthly spend cap, and lock production keys to your servers' IP addresses.
- Set an expiry on keys you hand out for a short job.
Anyone with a key can spend your balance. If one leaks, revoke or rotate it under API keys; it stops working on the next request.
Stuck? Email [email protected]System statusChangelog