Getting Started
Authentication
Authenticate server-side Qufas requests with Bearer API keys.
Bearer authentication
Every stable public API request requires a Qufas API key using Authorization: Bearer qf_sk_.... Create keys from Dashboard → API Keys; public API key creation and deletion endpoints are not currently available.
cURL
1curl https://qufas-ai.vercel.app/v1/models \2 -H "Authorization: Bearer $QUFAS_API_KEY"Keep keys server-side
- Load API keys from server-side secrets or environment variables.
- Never ship a key in browser, mobile, or public repository code.
- Use separate keys and model allowlists for each environment.
- Replace and revoke a key immediately if it may be compromised.
Three different identifiers
| x-qufas-request-id | Canonical Qufas trace ID returned by the gateway. |
| X-Request-ID | Optional client correlation input. In responses, this name is a compatibility alias containing the canonical Qufas ID. |
| Idempotency-Key | Duplicate-operation protection. It is not a request ID. |
A client-supplied X-Request-ID never replaces the canonical req_* identifier, and Qufas does not echo the client value as the response request ID. See Request IDs & Debugging.
Authentication errors
Missing, invalid, inactive, or malformed credentials return HTTP 401 with the stable error object. Expired keys return code expired_api_key.
401 JSON
1{2 "error": {3 "message": "Invalid API key.",4 "type": "authentication_error",5 "param": null,6 "code": "invalid_api_key"7 }8}Was this page helpful?