> ## Documentation Index
> Fetch the complete documentation index at: https://fliqr.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate your requests

> Generate an API access token and pass it in the X-ACCESS-TOKEN header on every Fliqr AI API request.

Every request to the Fliqr AI API must include a valid access token. Send the token in the `X-ACCESS-TOKEN` header. There are no session cookies or OAuth flows for these endpoints.

## Generate an access token

Access tokens are scoped to your Fliqr AI account. To generate a token:

1. Open your Fliqr AI dashboard and go to **Settings → API**.
2. Click **Create API Key**.
3. Give the key a descriptive name (for example, `production-backend` or `staging-integration`).
4. Copy the key immediately — it is shown **only once**. If you lose it, revoke it and create a new one.
5. Store the key in an environment variable or secrets manager before closing the dialog.

## Pass the token in requests

Include the token in the `X-ACCESS-TOKEN` header on every request:

```bash theme={null}
curl https://app.fliqr.ai/api/accounts/me \
  -H "X-ACCESS-TOKEN: YOUR_API_KEY" \
  -H "Content-Type: application/json"
```

Requests without this header — or with an invalid key — receive a `401 Unauthorized` response.

## Store keys as environment variables

Never hard-code API keys in source files. Set the key as an environment variable and reference it from your application:

```bash theme={null}
export FLIQR_API_KEY=your_access_token
```

Then read the variable in your application code:

```javascript theme={null}
const apiKey = process.env.FLIQR_API_KEY;

const response = await fetch('https://app.fliqr.ai/api/accounts/me', {
  headers: {
    'X-ACCESS-TOKEN': apiKey,
    'Content-Type': 'application/json',
  },
});
```

<Warning>
  Never commit API keys to source control. Use environment variables, a secrets manager, or your CI/CD platform's secrets store. Revoke a leaked key immediately.
</Warning>

## Rotate API keys

Rotate API keys periodically and always after a suspected exposure:

1. Go to **Settings → API** and create a replacement key.
2. Update your application or environment to use the new key.
3. Return to **Settings → API**, find the old key, and revoke it.

## Try it in the playground

Open any endpoint under the **API Reference** tab. Enter your access token in the authorization field (labeled `X-ACCESS-TOKEN`), fill in parameters, and send the request from the interactive playground.

Start with [Get account information](/docs/api-reference/accounts/get-account-information) to verify your token.

***

## What's next

<CardGroup cols={2}>
  <Card title="Rate limits" icon="gauge" href="/docs/api-reference/rate-limits">
    Understand request budgets, headers, and how to handle 429 responses.
  </Card>

  <Card title="Error codes" icon="triangle-exclamation" href="/docs/api-reference/errors">
    Browse error codes and how to interpret the error response object.
  </Card>
</CardGroup>