Skip to main content
An API key authenticates the REST API and the MCP server. Create one in the console under Settings → API keys, or through the API.
plainKey is shown once, at creation, and never again. Store it somewhere safe before you close the response. Afterwards only the prefix is visible, which is what identifies the key in a list.
A key looks like sk-af-v1- followed by 32 hex characters. Keys are stored hashed — nobody at Aflux can read yours back to you.

​
Spend limits

A key handed to an autonomous agent should carry a creditLimit. Campaign creation charges the whole budget in one call — a limit is what stops a bad prompt from becoming a large invoice.

​
Expiry

expiration is fixed at creation: NO_EXPIRATION, H_1, D_1, D_7 or D_30. A key past its expiresAt moves to EXPIRED and stops authenticating.

​
Managing keys

PATCH changes the name and the credit limit. Status is one of ACTIVE, DISABLED, EXPIRED. lastUsedAt tells you whether a key is still in use before you delete it.
A key carries your account’s full authority — every campaign it creates spends your balance. Treat it as a password: never commit it, never put it in a URL, and disable it the moment you suspect it leaked.