Authentication

The gateway authenticates every request with an API key that you create in the Fourier Platform console. The console itself uses your sign-in, not an API key.

Send the key

Put the key in the Authorization header with the Bearer scheme:

POST /v1/embeddings HTTP/1.1
Host: gateway.fourierhealth.com
Authorization: Bearer fh_Kq3xR8mZ2vLp_7Hd4Jn9Wc1Xf6Bt2Ry8Qm5Sz3Lk0Pv9G
Content-Type: application/json

The gateway reads the key from this header only.

Key format

A key is 48 characters: the prefix fh_, a 12-character key ID, an underscore, and a 32-character secret. Both parts use only the characters 0-9, A-Z, and a-z.

fh_Kq3xR8mZ2vLp_7Hd4Jn9Wc1Xf6Bt2Ry8Qm5Sz3Lk0Pv9G
   └─ key ID ─┘ └──────────── secret ──────────┘

The key ID identifies the key. The console shows it in the Key column as fh_Kq3xR8mZ2vLp_…Pv9G: the key ID, an ellipsis, and the last four characters of the secret. The platform stores only a hash of the secret, so the console can’t show the secret again.

Treat the whole key as a secret. The key ID alone can’t authenticate anything, so you can quote it in a support request.

What a key belongs to

Each key belongs to a project in your organization and can call the models Fourier Health has enabled for that organization.

Rejected requests

When the gateway rejects a key, it returns 401 with a code that says why: invalid_api_key, api_key_revoked, api_key_expired, project_archived, or organization_deleted. A key that can’t call the requested model gets 403 model_not_enabled. Revoking a key, letting it expire, and archiving its project all take effect on the next request. For the response format and every code, see Errors.

Keep keys secret

• Use keys only from servers you control, never in a browser, a mobile app, or a public repository.
• Load the key from an environment variable or a secret manager, not from source code.
• Create one key per service or environment and name it accordingly, so that revoking a key affects one thing.
• Set an expiration when you create the key. The console flags keys that expire within seven days.
• Rotate by creating a replacement key, deploying it, and revoking the previous one. For the procedure, see API keys.
• Removing a member from the organization, or a member deleting their account, revokes every key that member created. Create long-lived keys with an account that stays with the organization.