> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pornfactoryai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create, scope, store, and revoke developer API keys.

Every v1 request requires a Porn Factory AI developer key in the
`Authorization` header.

```http theme={"system"}
Authorization: Bearer pfai_YOUR_KEY
```

## Create a key

Open the [Developer tab](https://pornfactoryai.com/account?tab=developer) in
your account. Give the key a descriptive name, select only the scopes your
integration needs, and optionally set an expiration date.

The full API key and webhook secret are shown once. Store both in a secret
manager. Porn Factory AI stores only a hash of the API key and cannot display
it again.

<Warning>
  Never place an API key in browser code, mobile application bundles, public
  repositories, logs, analytics events, or query parameters. Call the API from
  your server.
</Warning>

## Scopes

| Scope                | Allows                                                |
| -------------------- | ----------------------------------------------------- |
| `catalog:read`       | List generator-ready checkpoints and LoRAs            |
| `credits:read`       | Read the account's credit balance                     |
| `generations:create` | Submit image and video generations                    |
| `generations:read`   | Poll requests and receive owner-authorized media URLs |

Use separate keys for production, staging, and local development. Revoke a key
immediately if it may have been exposed.

## Authentication errors

* `401 unauthorized`: the key is missing, malformed, expired, revoked, or unknown.
* `403 forbidden`: the key lacks the required scope or its account is suspended.
* `429 rate_limited`: the key exceeded its request window.

Authenticated responses include `X-RateLimit-Limit`,
`X-RateLimit-Remaining`, and `X-RateLimit-Reset` headers.