Skip to main content
Every request carries your API key in the X-API-Key header. There is nothing else to set up.

​
Keys and workspaces

A key belongs to a workspace, and the workspace holds the credits your calls use. You can make as many keys as you like, for example one per environment or per service, and revoke any of them from the dashboard without touching the others. Keys start with hf_. Anyone who has your key can spend your credits.
Never put your API key in browser code, a public repository or a mobile app. Call Hydrafetch from your own server and keep the key in an environment variable or a secrets manager. The only key meant for the browser is a publishable key, used for logos.

​
When a key is refused

A refused request does no work and costs nothing. The error says why, in the same shape as every other error. No key, or a wrong or revoked key answers 401:
When the header is missing, the message says Missing X-API-Key header instead. An expired key also answers 401, with the date it expired: This API key expired on Oct 1, 2026. Create a new key in the dashboard. A key locked to IP addresses, called from somewhere else, answers 403 and names the address the call came from:
API keys explains how to set an expiry and allowed addresses.

​
Rotating a key

  1. Create a new key in the dashboard.
  2. Deploy it wherever the old one is used.
  3. Revoke the old key. This takes effect at once.
Your credits, usage history and other keys are not affected.

Next: Credits

What each call costs, and why failed calls are free.