Authentication
Every request carries an API key that identifies your organization. Organizations get keys from Grihafy; see Getting access.
Send the key
Use either header on every request. Both work the same way.
Authorization: Bearer gfy_test_...Create a key
- An organization owner or admin opens
/org/your-org/settings/api-keysin the Grihafy web app. - Choose test or live, and an expiry of 30, 90 or 365 days, or no expiry.
- Copy the key right away. It is shown only once.
| Key | Prefix | What it does |
|---|---|---|
| Test | gfy_test_ | Returns the same sample result for any image. Uses no credits and no AI. See Sandbox. |
| Live | gfy_live_ | Analyzes real floor plans and uses one credit per analysis. |
Check that a key works
Read the credit balance. A test key answers with available: null because it never uses credits.
curl https://api.grihafy.com/v1/credits \
-H "Authorization: Bearer gfy_test_..."Keep keys on your server
Every key can read and write all of your organization analyses and read its credit balance. There are no per-key permissions. Keep keys in server-side configuration, out of browser code, mobile apps and source control, and revoke an exposed key immediately in organization settings.
Authentication errors
| Response | Meaning |
|---|---|
401 unauthorized | The key is missing, malformed, revoked or expired, or its organization no longer exists. Create a new key. |
403 org_suspended | Your organization is suspended. Analyses already running finish, but you cannot create new ones. Contact us. |
Test and live keys see separate data: a test key never reads live analyses, and a live key never reads test analyses. See the API reference for the security scheme.