Authentication

Every request needs an API keyAuthorization: Bearer YOUR_API_KEY

In production, keep the key on the server side and let your backend call HiAPI.

Getting Your API Key

1. Sign up at hiapi.ai
2. Go to Dashboard → API Keys
3. Click Create New Key
4. Copy the key and store it securely — it won’t be shown again

Using Your API Key

Include the key in the Authorization header with the Bearer prefix:

cURL

curl -X POST https://api.hiapi.ai/v1/tasks \
  -H "Authorization: Bearer sk-your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-image-2", "input": {"prompt": "minimal product icon, warm orange accent"}}'

Python

import os
import requests

response = requests.post(
    "https://api.hiapi.ai/v1/tasks",
    headers={
        "Authorization": f"Bearer {os.environ['HIAPI_API_KEY']}",
        "Content-Type": "application/json",
    },
    json={
        "model": "gpt-image-2",
        "input": {"prompt": "minimal product icon, warm orange accent"}
    },
)

print(response.json())

Node.js

const response = await fetch("https://api.hiapi.ai/v1/tasks", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.HIAPI_API_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    model: "gpt-image-2",
    input: { prompt: "minimal product icon, warm orange accent" }
  })
});

console.log(await response.json());

Security Best Practices

• Never expose your API key in browser code, mobile bundles, or public repositories
• Use environment variables to store your key: HIAPI_API_KEY
• Rotate keys regularly from the Dashboard and re-verify the request path after rotation
• Use separate keys for development and production
• Proxy requests through your backend if end users can submit prompts or files

Error Responses

Status Code	Meaning
401	Invalid or missing API key
403	API key doesn’t have permission
429	Rate limit exceeded