Create and manage API credentials in Higgsfield Cloud. Each credential consists of a key ID and a secret.
Send both values in the Authorization header:
The API also accepts the legacy hf-api-key and hf-secret headers. New integrations should use the Authorization header.
Keep credentials server-side
Do not call the API directly from browser or mobile application code. Anyone who can inspect the application can extract its API secret and use your account.
- Store credentials in a secrets manager or encrypted environment variables.
- Use separate credentials for development and production.
- Never include credentials in URLs, logs, screenshots, or support messages.
- Rotate a credential immediately if it may have been exposed.
Authentication errors
Missing, malformed, or invalid credentials return 401 Unauthorized:
Authentication identifies the account, but individual models may have separate access restrictions. A model unavailable to the authenticated account can return 404, 423, or 503 depending on its operational state. 