Authentication

Every request to the FluidGhost API is authenticated with an API key you generate in the dashboard and send as a bearer token. There is no OAuth flow and no browser session to manage — paste the key into your integration and go.

Get your key

1. Sign in at https://ghost.fluidvip.com.
2. Open Settings → API keys.
3. Create a key and copy it. It is shown once — store it in a secret manager or environment variable, never in source control.

A key looks like:

fg_sk_live_8f3c2a7b9e1d4c6f…

The live segment marks a production key. A fg_sk_test_… key runs against the sandbox (jobs are validated and billed at zero, useful for wiring up your integration). Both are sent the same way.

Send the key

Put the key in the Authorization header as a Bearer token:

curl https://api-ghost.fluidvip.com/api/options \
  -H "Authorization: Bearer fg_sk_live_8f3c…"

Every route under /api requires this header. A missing or malformed header returns 401 unauthorized; a well-formed header with an unknown or revoked key also returns 401.

The web app authenticates differently. The FluidGhost web Studio signs in with your dashboard session (a short-lived JWT) rather than an API key. Both are accepted on the same endpoints and resolve to the same account, so a job you submit via the API shows up in your dashboard history and vice-versa. API keys are the credential for your own code.

What a key authorizes

A key acts as your account. It can do everything in these docs for that account only:

• submit and poll your spoof jobs,
• download your one-time results,
• spend your shared balance.

It can never see another account's jobs — every job is owner-scoped, and a job that isn't yours returns 404 not_found (the API never reveals that someone else's job exists).

Keys do not perform account-level operations. Generating or revoking keys, topping up your balance, and managing your team live in the dashboard, not the API.

Live vs test keys

The prefix tells you whether a key is production or sandbox:

Prefix	Mode	Notes
fg_sk_live_	Live	Production. Jobs run and bill against your balance.
fg_sk_test_	Test	Sandbox. Jobs are validated and billed at zero — useful for wiring up your integration.

Both are sent the same way. A key is spoof-only: it can submit jobs and read/download their results, and nothing else.

Rotating and revoking

• Rotate by generating a new key, deploying it, then revoking the old one — there's no downtime because both are valid until you revoke.
• Revoke a key in the dashboard the instant it might be exposed. Revocation is immediate: the next request with that key returns 401.

Treat a key like a password. If one leaks, revoke it and rotate. Because a key can spend your balance, a leaked key is a spending risk as well as a data one — see Responsible use.

Keeping the key server-side

Send jobs from a server you control, never from a browser or a mobile app you ship to users — a key embedded in client code is a key you've published. If you need to let end users submit jobs, put your own backend in front: your backend holds the FluidGhost key, authenticates your users its own way, and calls FluidGhost on their behalf.