Authentication

Machine credentials are API keys. The gateway ignores Authorization and Bearer.

There is no flash_live_ / flash_test_ split — one prefix, one credit pool.

1
Send the key
Send the secret as X-FlashAPI-Key. Keys look like flash_ followed by a random string.
curl
```
curl -sS https://api.flashapi.io/youtube/v1/video/dQw4w9WgXcQ \
  -H "X-FlashAPI-Key: flash_…"
```
2
What the gateway does
It hashes the key, looks it up in KV, and fail-closes on a miss with 401 INVALID_API_KEY. GET /health skips auth.
Disabled accounts get 403 ACCOUNT_DISABLED; a key that cannot call that product gets 403 FORBIDDEN.

Dashboard #

Mint and revoke keys in the dashboard. The full secret is shown once; the dashboard stores a hash and a short prefix.