Skip to main content
Create and manage API credentials in Higgsfield Console. Each credential consists of a key ID and a secret.

​
Authorization header

Send both values in the Authorization header:
The API also accepts the legacy hf-api-key and hf-secret headers. New integrations should use the Authorization header.

​
Keep credentials server-side

Do not call the API directly from browser or mobile application code. Anyone who can inspect the application can extract its API secret and use your account.
  • Store credentials in a secrets manager or encrypted environment variables.
  • Use separate credentials for development and production.
  • Never include credentials in URLs, logs, screenshots, or support messages.
  • Rotate a credential immediately if it may have been exposed.

​
Authentication errors

Missing, malformed, or invalid credentials return 401 Unauthorized:
Authentication identifies the account, but individual models may have separate access restrictions. A model unavailable to the authenticated account can return 404, 423, or 503 depending on its operational state.