Headers - Higgsfield API Docs

Request headers

Header	Required	Applies to	Description
`Authorization`	Yes	All endpoints	`Key <key-id>:<key-secret>`. See Authentication.
`Content-Type`	For a body	Requests with a JSON body	`application/json`.
`Idempotency-Key`	No	Generation requests	1–255 visible ASCII characters, a UUID is recommended. Retrying with the same key returns the original request instead of creating a new one. See Idempotent requests.
`Hf-Expires-After`	No	Generation requests	Seconds to keep the request’s data after it finishes, from 3600 to your account retention. It can only shorten retention; out-of-range values return `422`. See Data retention and deletion.

hf-api-key and hf-secret are accepted as a legacy alternative to Authorization. New integrations should use Authorization.

Query parameters

Parameter	Applies to	Description
`hf_webhook`	Generation requests	URL-encoded HTTPS endpoint that receives the result when the request finishes. See Webhooks.

Response headers

Header	Returned	Description
`X-Correlation-ID`	Every response	Identifier Higgsfield assigns to this API call. Record it with the `request_id` and include both when contacting support.
`Retry-After`	`429` responses	Seconds to wait before retrying. See Rate limits.
`Cache-Control: no-store`	`403` responses for a disabled or expired API key	Do not cache the error.

Webhook delivery headers

Sent by Higgsfield with every webhook delivery to your endpoint.

Header	Description
`webhook-id`	Event identifier, the same across retries of one event. Use it to deduplicate.
`webhook-timestamp`	Unix time in seconds when the delivery was signed.
`webhook-signature`	One or more space-separated `v1,<base64>` signatures. See Verify signatures.
`X-Webhook-Secret-Key`	Legacy: the secret passed with the webhook in the request body, for integrations that set one. It will be retired; verify signatures instead.