Authentication

API keys

Create and manage keys at Settings → API Keys. Keys start with pfig_ and are shown in full only once, at creation time. Deleting a key immediately revokes it.

Keys are tied to your account: API usage consumes the same credit balance as the web app, and files generated through the API are stored in your account's storage.

Sending the key

Pass the key as a Bearer token (recommended):

curl https://patentfig.ai/api/v1/credits \
  -H "Authorization: Bearer pfig_xxx"

The x-api-key header is also accepted:

curl https://patentfig.ai/api/v1/credits \
  -H "x-api-key: pfig_xxx"

Rate limits

Each key allows 60 requests per minute. When exceeded, requests return 429 with the error code RATE_LIMITED; retry after a short delay.

Errors

Failed authentication returns:

{
  "success": false,
  "error": { "code": "UNAUTHORIZED", "message": "Invalid or expired API key." }
}

See Errors for the full error code table.

Security notes

• Treat keys like passwords. Do not embed them in client-side code or public repositories.
• Create separate keys per integration so they can be revoked independently.
• If a key leaks, delete it in Settings — revocation is immediate.