Authentication

One key for everything

Authentication is a partner API key shaped fl_live_<64 hex>. The same key works on every endpoint: generation, billing, key management.

Pass it in one of two ways:

# X-API-Key header (recommended)
curl -H "X-API-Key: $FRANKLAB_KEY" https://apergrex.ru/franklab/api/v1/billing/balance

# Or Authorization: Bearer
curl -H "Authorization: Bearer $FRANKLAB_KEY" https://apergrex.ru/franklab/api/v1/billing/balance
⧉

Response statuses

Rate limits

On top of the per-partner limit there is a gateway-wide limit (100 requests/minute per IP). A 429 response is safe to retry with a delay.

Key safety

• The key is stored server-side as a hash only — it cannot be "shown again"; a lost key is revoked and replaced.
• Send the key over HTTPS only — never in URLs, logs or client-side code.
• Revoke instantly with DELETE /v1/billing/api-keys/{id} (revoking the key the request itself uses is allowed).
• Use a separate key per integration — labels keep them apart in the list.

Managing keys via the API

# create
curl -X POST -H "X-API-Key: $FRANKLAB_KEY" -H "Content-Type: application/json" \
  -d '{"label":"n8n automation"}' \
  https://apergrex.ru/franklab/api/v1/billing/api-keys

# list (prefixes only; the raw value is never returned)
curl -H "X-API-Key: $FRANKLAB_KEY" https://apergrex.ru/franklab/api/v1/billing/api-keys

# revoke
curl -X DELETE -H "X-API-Key: $FRANKLAB_KEY" \
  https://apergrex.ru/franklab/api/v1/billing/api-keys/<id>
⧉

⧉ Section as Markdown