> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vidgen.id/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Send your Vigen API key through the Authorization Bearer header or x-api-key.

Every endpoint except `GET /api/v1/models` requires an API key. The key is read from two possible headers — pick one.

```bash Authorization header theme={null} theme={null}
curl https://vigen.id/api/v1/user/credits \
  -H "Authorization: Bearer vg_4b1a82f3c9d0e1f2a3b4c5d6e7f80912"
```

```bash x-api-key header theme={null} theme={null}
curl https://vigen.id/api/v1/user/credits \
  -H "x-api-key: vg_4b1a82f3c9d0e1f2a3b4c5d6e7f80912"
```

```js Node.js theme={null} theme={null}
const headers = { Authorization: `Bearer ${process.env.VIGEN_API_KEY}` };

// or
const headers = { "x-api-key": process.env.VIGEN_API_KEY };
```

```python Python theme={null} theme={null}
headers = {"Authorization": f"Bearer {os.environ['VIGEN_API_KEY']}"}

# or
headers = {"x-api-key": os.environ["VIGEN_API_KEY"]}
```

```js fetch (browser-safe) theme={null} theme={null}
await fetch("https://vigen.id/api/v1/user/credits", {
  headers: { "x-api-key": import.meta.env.VITE_VIGEN_API_KEY },
});
```

```js axios theme={null} theme={null}
import axios from "axios";

export const vigen = axios.create({
  baseURL: "https://vigen.id/api/v1",
  headers: { Authorization: `Bearer ${process.env.VIGEN_API_KEY}` },
});
```

## Key format

* Always starts with `vg_`, followed by 32 hexadecimal characters.
* `Bearer` is case-insensitive (`bearer vg_...` is accepted too).
* The `vg_` prefix is mandatory. A key without the prefix is rejected even if the rest is correct.
* Keys are created on the [dashboard API key page](https://docs.vidgen.id/en/register.md); the raw key is shown only once.

## Authentication failures

| Status | Message | Cause |
| - | - | - |
| `401` | `Header Authorization (Bearer vg_...) atau x-api-key diperlukan.` | No header at all. |
| `401` | `Format API Key tidak valid. API Key Vigen harus diawali dengan "vg_".` | Wrong prefix, or the key belongs to another service. |
| `401` | `API Key tidak valid atau telah dicabut.` | The key hash is not in the database — typo, or it was revoked. |
| `401` | `Pengguna pemilik API Key tidak ditemukan.` | The account that owns the key has been deleted. |
| `503` | `...Vigen sedang dalam pemeliharaan. Penggunaan API key dinonaktifkan sementara.` | The site is temporarily closed. Try again later. |
| `503` | `Layanan autentikasi API Key sedang tidak tersedia.` | The session service has a problem. Retry with backoff. |

> [!NOTE]
>
> Every authentication failure uses the same body shape: `{ "error": "..." }`. There is no numeric `code` — use the HTTP status to tell them apart.

## Security

> [!TIP]
>
> **Send it over HTTPS only.** A key must never travel through an `http://` URL or be pasted into a query string.

> [!TIP]
>
> **Name each key after its environment.** `staging`, `prod-cron`, `lokal-andi` — so that revoking one key does not take another system down.

> [!WARNING]
>
> **Do not use a dashboard key in an end user's browser.** Every API request deducts credits from the key owner's account. For a multi-user product, keep the key on your server and allow access only from there.

> [!CAUTION]
>
> **Do not store keys in mobile apps or frontend bundles that can be unpacked.** If a key leaked, revoke it and create a new one — rotation is the only way to revoke.

## Endpoints that do not need a key

`GET /api/v1/models` may be called without authentication because it only contains the public catalog. If your application shows prices or balances, still send a key.

Continue to [Base URL](https://docs.vidgen.id/en/api-base-url.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.