# Authentication

Generations need an API key, sent as a bearer token. Keep it on your server. The model list, status and price estimate need no key.

```bash cURL
export VIDLAB_API_KEY="vidlab_sk_your_key_here"

curl https://vidlab.ai/v1/balance \
  -H "Authorization: Bearer $VIDLAB_API_KEY"
```

```python Python
import os, requests

r = requests.get(
    "https://vidlab.ai/v1/balance",
    headers={"Authorization": f"Bearer {os.environ['VIDLAB_API_KEY']}"},
)
print(r.json())
```

```js JavaScript
const res = await fetch("https://vidlab.ai/v1/balance", {
  headers: { Authorization: `Bearer ${process.env.VIDLAB_API_KEY}` },
});
console.log(await res.json());
```

| Header | What it is |
| - | - |
| `Authorization` | `Bearer vidlab_sk_...`. The key starts with `vidlab_sk_`. |
| `x-api-key` | The same key, for clients that cannot set `Authorization`. |

## Make a key

Keys are made in the dashboard, from a signed-in browser: open [API keys](/vidlab-api/api-keys), accept the Developer API terms and create one. An API key cannot make other keys.

- The full key is shown once, when you create it. VidLab stores only a hash, so a lost key cannot be shown again: make a new one.
- You can keep up to 25 live keys. Delete a key on the same page to revoke it at once.
- Keys have full access: they start and poll generations, read the balance and use the [MCP endpoint](/vidlab-api/docs/mcp).

## Keep it safe

- Put the key in an environment variable (`VIDLAB_API_KEY`) or your platform's secret store. Never in source code, a committed file, a URL or a prompt.
- Call the API from your server, never from a browser or a mobile app, where anyone can read the key.
- Use one key per app, so you can revoke one without breaking the rest. If a key leaks, delete it straight away.

## When it fails

| Status | Code | Why |
| - | - | - |
| 401 | `unauthorized` | The key is missing, unknown, revoked or expired. |
| 403 | `api_key_required` | Generations take a `vidlab_sk_` key only; another kind of token was sent. |
| 403 | `developer_access_forbidden` | The account does not have API access yet. Write to [support@vidlab.ai](mailto:support@vidlab.ai). |