Authentication: one API key, sent as a Bearer token

Updated 2026-10-30

You sign in with an email link and copy one API key. Send it in the Authorization header. Keys start with afk_. We show the full key once. We store only a hash. One key works for the REST API and the creator MCP server.

Get a key

  1. Enter your email on the home page, or call POST /v1/signup.
  2. Open the magic link we send you within 15 minutes. It signs you in to the dashboard.
  3. Copy the key the dashboard shows. This is the only time you see all of it.
bash
curl -X POST https://aiformapi.com/v1/signup \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com"}'

Signup is limited to 3 requests per hour for each IP address and 3 per day for each email address. When spam protection is on, the request also carries a turnstile_token. The dashboard form handles that for you.

Send the key

Put the key in the Authorization header with the word Bearer.

bash
curl https://aiformapi.com/v1/forms \
  -H "Authorization: Bearer afk_your_key_here"
js
const res = await fetch("https://aiformapi.com/v1/forms", {
  headers: { Authorization: `Bearer ${process.env.AIFORMAPI_KEY}` },
});
python
import os, requests

r = requests.get(
    "https://aiformapi.com/v1/forms",
    headers={"Authorization": f"Bearer {os.environ['AIFORMAPI_KEY']}"},
    timeout=30,
)

If the key is missing or wrong you get 401 with the code unauthorized. Every error uses the same JSON shape. See Errors.

What the key looks like

PartValue
Prefixafk_
Body32 characters, letters and digits (base62)
Stored by usA SHA-256 hash and the first 8 characters, so the dashboard can show you which key is active
Shown to youIn full, once

Which endpoints need a key

Endpoint groupCredential
/v1/forms and everything under it, /v1/usageAPI key
Creator MCP at /mcpAPI key in the header
/v1/public/forms/{slug} and its responsesNone. These are for people filling a form.
/v1/public/forms/{slug}/fill-tokensNone
/v1/fill/{token} and the fill MCP at /mcp/fillThe fill token is the credential
/openapi.jsonNone

A fill token is not an API key. It works for one form, one successful submit and 60 minutes. See Fill API.

Keep the key safe

  • Read it from an environment variable. Do not write it into code.
  • Never put it in a web page, a mobile app or any code that runs in a browser. Call the API from a server.
  • Do not commit it. Add the file that holds it to .gitignore.
  • Give it to your AI agent only through the MCP client config. See MCP.
  • Watch your usage with GET /v1/usage or the usage bars in the dashboard settings.

If a key leaks, rotate it in the dashboard settings and update every place that uses it. Do this first. Look for damage after.

Limits that follow the key

The free plan allows 30 requests per minute and 1,000 per day for each key. REST calls and creator MCP calls count together. Every response from a rate-limited endpoint carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset. See Rate limits and quotas.

Next