Authentication

API keys

Create a key in Settings → API. Keys are prefixed fl_ and shown only once - store them securely, since Reeloop never displays it again after creation.

Using the key

Send it as a Bearer token on every request:

Authorization: Bearer fl_your_api_key_here

An X-API-Key header with the raw key also works, for HTTP clients or gateways that don't let you set a custom Authorization scheme.

Which plan you need

The public API and MCP server are available on the Growth and Pro plans. This is checked on every request, not only when the key is created - if you downgrade below Growth, keys minted while you were on it stop working immediately rather than staying free forever:

{ "error": { "code": "upgrade_required", "message": "The public API and MCP are available on the Growth and Pro plans. Upgrade at reeloop.ai/pricing." } }

Sandbox keys

A key minted with Test mode on gets the fl_test_ prefix instead of fl_. Test keys run the full request path - auth, rate limiting, moderation, validation - but the render itself is simulated: no provider calls, no credits spent, and the job completes immediately with a sample video. Use one while building an integration so you can exercise your webhook or polling logic without paying for real renders, then switch to a live key when you're ready to ship.

Rotating a key

Rotating a key doesn't cut your integration off mid-deploy: the old key keeps validating for a grace window after you rotate, then is rejected exactly like an unknown key once that window passes. Revoke a compromised key immediately instead from Settings → API if you can't wait out the grace window - that takes effect at once, with no grace period.

Key hygiene

• Keys grant full access to your account's renders and credits - treat them like passwords.
• Create one key per integration so you can revoke a single leak without rotating everything.
• A key is scoped to the workspace it was created in at mint time, so switching your active workspace in the dashboard later doesn't silently move where an existing key's requests land.

Errors

A missing or invalid key returns 401 Unauthorized:

{ "error": { "code": "unauthorized", "message": "Invalid or missing API key. Pass it as 'Authorization: Bearer fl_…'." } }