API Authentication

All WaveSpeedAI API requests require authentication using an API key.

How It Works

Include your API key in the Authorization header as a Bearer token:

Authorization: Bearer YOUR_API_KEY

Every request to the API must include this header. Requests without a valid API key will return 401 Unauthorized.

Get Your API Key

Go to API Keys
Click Generate to create a new key
Copy and store it securely — you won’t be able to see it again

Note: API keys require a top-up to activate. Keys created before your first top-up will not work.

Code Examples

cURL

curl --fail-with-body --connect-timeout 10 --max-time 60 \
  -X POST "https://api.wavespeed.ai/api/v3/wavespeed-ai/z-image/turbo" \
  -H "Authorization: Bearer $WAVESPEED_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "A cat in space", "size": "1024*1024"}'

Python

import os
import requests
 
api_key = os.environ["WAVESPEED_API_KEY"]
 
response = requests.post(
    "https://api.wavespeed.ai/api/v3/wavespeed-ai/z-image/turbo",
    headers={
        "Authorization": f"Bearer {api_key}",
        "Content-Type": "application/json"
    },
    json={"prompt": "A cat in space", "size": "1024*1024"},
    timeout=(10, 60),
)
response.raise_for_status()
body = response.json()
if body.get("code") != 200:
    raise RuntimeError(body.get("message", "Task submission failed"))
print(body["data"])

JavaScript

const apiKey = process.env.WAVESPEED_API_KEY;
if (!apiKey) throw new Error("Set WAVESPEED_API_KEY");
 
const response = await fetch("https://api.wavespeed.ai/api/v3/wavespeed-ai/z-image/turbo", {
    method: "POST",
    headers: {
        "Authorization": `Bearer ${apiKey}`,
        "Content-Type": "application/json"
    },
    body: JSON.stringify({ prompt: "A cat in space", size: "1024*1024" }),
    signal: AbortSignal.timeout(60_000)
});
const body = await response.json();
if (!response.ok || body.code !== 200) {
    throw new Error(body.message || `HTTP ${response.status}`);
}
console.log(body.data);

Security Best Practices

Practice	Why
Use environment variables	Never hardcode API keys in your source code
Keep keys secret	Don’t commit keys to Git or share them publicly
Server-side only	Never expose keys in frontend/browser code
Rotate regularly	Generate new keys periodically and delete old ones
Use separate keys	Create different keys for different projects or environments

Setting Environment Variables

Linux / macOS

export WAVESPEED_API_KEY="your-api-key"

Windows (PowerShell)

$env:WAVESPEED_API_KEY="your-api-key"

Windows (CMD)

set WAVESPEED_API_KEY=your-api-key

Managing API Keys

You can create multiple API keys from wavespeed.ai/accesskey:

Create — Generate new keys for different projects
Rename — Update key names for easier identification
Delete — Revoke keys that are no longer needed

Deleted keys stop working immediately.

Error Codes

Code	Message	Solution
`401`	Unauthorized	Check your API key is correct
`403`	Forbidden	Your account may be suspended — contact support
`429`	Too Many Requests	You’ve hit rate limits — wait or upgrade your account level

Common Issues

API key not working?

Make sure you’ve made at least one top-up (required to activate API access)
Check for extra spaces when copying the key
Verify the key hasn’t been deleted
Ensure you’re using the correct header format: Authorization: Bearer YOUR_KEY

Need more rate limits?

Upgrade your account by adding credits. See Account Levels for tier details.

Next Steps

Get Started with API — Make your first API call
How to Submit Task — API request details
Account Levels — Rate limits and tiers

Get Started with API Browse Models