Authentication

The Fluxpool API uses API keys for authentication. All requests require a valid key sent as a Bearer token — the same format used by the OpenAI API.

API Keys

Your API key is generated in the Fluxpool app (API / MCP Access). Keys are prefixed with fp_live_ followed by 40 hex characters, and look like this:

fp_live_a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e

Get your API key →

Making Requests

Include your API key in the Authorization header of every request.

Header Format

Authorization: Bearer fp_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

cURL Example

curl https://api.fluxpool.ai/v1/images/generations \
  -H "Authorization: Bearer fp_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "flux-2-pro",
    "prompt": "A dragon on a neon-lit Tokyo rooftop, 8K",
    "size": "1024x1024"
  }'

Python Example

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.fluxpool.ai/v1",
    api_key=os.environ["FLUXPOOL_API_KEY"]
)

response = client.images.generate(
    model="flux-2-pro",
    prompt="A dragon on a neon-lit Tokyo rooftop, 8K",
    size="1024x1024"
)

print(response.data[0].url)

JavaScript / Node.js Example

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://api.fluxpool.ai/v1",
  apiKey: process.env.FLUXPOOL_API_KEY,
});

const response = await client.images.generate({
  model: "flux-2-pro",
  prompt: "A dragon on a neon-lit Tokyo rooftop, 8K",
  size: "1024x1024",
});

console.log(response.data[0].url);

OpenAI SDK Compatibility

The Fluxpool API is OpenAI-compatible. If you already use the OpenAI Python or Node.js SDK, change two values: base_url and api_key. Everything else works as-is.

API Key Management

Manage your keys on the API / MCP Access page in the app.

Creating a Key

1. Go to API / MCP Access.
2. Click "Create new key."
3. Give it a name (e.g., production, staging, my-app).
4. Copy the key immediately — it is shown only once.

Rotating Keys

To rotate a key without downtime:

1. Create a new key.
2. Update your application to use the new key.
3. Verify requests succeed with the new key.
4. Revoke the old key.

Revoking Keys

Revoke any key instantly from the dashboard. Revoked keys stop working immediately — all in-flight requests using that key will fail.

Multiple Keys

You can create multiple API keys per account. Use separate keys for different environments (development, staging, production) or applications to isolate usage tracking and simplify rotation.

Limits

{
  "error": {
    "message": "You have 10 generations running and your plan allows 10 at once. Wait for one to finish, or upgrade for more.",
    "type": "invalid_request_error",
    "param": null,
    "code": "CONCURRENCY_LIMIT_REACHED"
  }
}

Handling a 429

When all of your plan's generations are running, the API returns 429 with CONCURRENCY_LIMIT_REACHED. Wait for one to finish and retry with exponential backoff. The OpenAI SDK raises a 429 as RateLimitError. A CONNECTION_LIMIT_REACHED 429 will not clear by retrying soon, so don't loop on it.

import time
from openai import OpenAI, RateLimitError

client = OpenAI(
    base_url="https://api.fluxpool.ai/v1",
    api_key="fp_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
)

def generate_with_retry(prompt, max_retries=3):
    for attempt in range(max_retries):
        try:
            return client.images.generate(
                model="flux-2-pro",
                prompt=prompt
            )
        except RateLimitError as e:
            # 429: too many generations running at once.
            # A connection's daily limit won't clear by retrying soon.
            if e.code != "CONCURRENCY_LIMIT_REACHED":
                raise
            wait = 2 ** attempt
            time.sleep(wait)
    raise Exception("Still at the concurrency limit after retries")

Security Best Practices

• Use environment variables. Never hardcode keys in source code.
  Bash Copy

  export FLUXPOOL_API_KEY=fp_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

• Never expose keys client-side. API calls must originate from your server or backend, not from browsers or mobile apps.
• Use separate keys per environment. production, staging, and development keys make rotation and auditing simpler.
• Rotate keys periodically. Even without a suspected compromise, rotate keys every 90 days.
• Revoke compromised keys immediately. If a key is leaked in a public repo, logs, or error message, revoke it from the API / MCP Access page and create a new one.
• Monitor usage. Check the Dashboard for unexpected spikes in generation volume, which could indicate key compromise.

Errors

Authentication-related error responses:

{
  "error": {
    "type": "invalid_api_key",
    "message": "The API key provided is invalid or has been revoked.",
    "code": 401
  }
}