Authentication

API tokens

Every call to the v1 API is authenticated with a bearer token. Tokens are minted in the dashboard, shown once, and stored only as a hash — there is nothing to sign and no expiry to refresh.

Mint a token

Go to account → API Tokens, give the token a name that says where it will live (“production worker”, “local dev”), and create it. The plaintext value appears once, at creation.

Token shape

esk_1f4c9a7b3e2d5081c6a4f9b2e7d3c058a1b6e4f9

ElliSekiz stores only the SHA-256 hash of a token. If you lose the plaintext, no one can recover it — create a new token and delete the old one.

Send it

Put the token in the Authorization header as a bearer credential. It works the same on every endpoint.

Request

curl https://ellisekiz.ai/api/v1/models \
  -H "Authorization: Bearer $ELLISEKIZ_TOKEN"

Node.js

const res = await fetch("https://ellisekiz.ai/api/v1/generations", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.ELLISEKIZ_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ model: "flux-schnell", prompt: "a lighthouse at dawn" }),
});

Python

import os, requests

res = requests.post(
    "https://ellisekiz.ai/api/v1/generations",
    headers={"Authorization": f"Bearer {os.environ['ELLISEKIZ_TOKEN']}"},
    json={"model": "flux-schnell", "prompt": "a lighthouse at dawn"},
)

What a token carries

Field	Type	Description
`Identity`	implicit	The account that minted it. Generations, spend and history are attributed to that account.
`Balance`	implicit	The prepaid USD balance the token draws on, shared by every token on the account.
`Routing policy`	implicit	The account's cheapest-first or priority policy, unless a request pins a provider.
`Expiry`	none	Tokens do not expire. They stop working the moment you delete them.

Rotate and revoke

Create the replacement token first, deploy it, then delete the old one — deletion takes effect immediately.
Use one token per environment so revoking staging never touches production.
Each token records a last-used timestamp in the dashboard; a token that has gone quiet is safe to remove.
Never ship a token in client-side code — anything in a browser bundle is public. Call the API from your server.

Failure modes

Field	Type	Description
`401`	Unauthorized	Missing header, malformed value, or a token that no longer exists. The response body is { "error": "Invalid or missing API token" }.
`402`	Payment required	The token is valid but the balance cannot cover the generation. Top up on billing.
`404`	Not found	The generation exists but belongs to another account. Generations are readable only by the account that created them.

← PreviousCreate an app Next →List models and prices