Getting an API key

A mainnet API key is a Resource Server's credential. It is a high-entropy string prefixed fsk_, so a leaked key is easy to spot in logs and scanners. The Facilitator stores only its SHA-256 digest, never the key itself — which is why the plaintext is shown once at issuance. A key can carry an expiry, be revoked (revocation is final), or be rotated with an overlap window so a replacement works before the old key retires.

Testnet needs no API key

Point your integration at a testnet deployment and call /verify and /settle right away, with no credential to obtain. API keys are a mainnet requirement.

Mainnet requires one because its payment endpoints sponsor real network fees on the Buyer's behalf: they fail closed to callers without a valid key, tying each sponsored transaction to a known Resource Server and its fee budget, so the fee sponsorship cannot be drained by unauthorized traffic.

For mainnet, get your key from the AgentSmith platform. Sign in there, register your Resource Server, and the platform issues the key — shown once, so store it in backend secret storage immediately. Rotate or revoke the key in the platform. Running your own Facilitator? You issue keys yourself — see Self-hosting.

Send the key on every mainnet request as Authorization: Bearer <API_KEY>. Use GET /supported to check the selected deployment's advertised capabilities; an endpoint error does not establish supported payment capabilities.