Authentication

V2Fun API uses Bearer Token authentication. Every request must include a valid API key issued to your account.

Obtaining an API Key

API keys are managed through the V2Fun developer console. Contact us or visit your account dashboard to create and manage your keys.

Keep your key safe

Treat your API key like a password. Never expose it in client-side code, public repositories, or logs.

Making Authenticated Requests

Include your API key in the Authorization header of every request:

Authorization: Bearer YOUR_API_KEY

Code examples

cURL

curl -X POST "https://api.v2fun.ai/api/v1/images/generations" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "A beautiful sunset"}'

JavaScript

const response = await fetch("https://api.v2fun.ai/api/v1/images/generations", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_API_KEY",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({ prompt: "A beautiful sunset" })
});

Python

import requests

response = requests.post(
    "https://api.v2fun.ai/api/v1/images/generations",
    headers={
        "Authorization": "Bearer YOUR_API_KEY",
        "Content-Type": "application/json"
    },
    json={"prompt": "A beautiful sunset"}
)

API Key Scopes

Each API key is granted one or more scopes that control which endpoints it can access. Calling an endpoint without the required scope returns 403 Forbidden.

Scope	Description
image:prompt	Image captioning and prompt enhancement
image:imgen	Text-to-image generation
image:imgedit	Image editing
model:mesh	Text / image to 3D mesh generation
model:texture	3D model texture generation
model:remesh	3D model remeshing
model:convert	3D model format conversion
model:render	3D model rendering
motion:animate	Animation retargeting
motion:query	Motion retrieval
video:capture	Video motion capture (pose detection, motion detection)
asset:read	Read generated asset files

INFO

Contact us if you need access to additional scopes not currently assigned to your key.

Security Best Practices

• Use environment variables — store your key in .env files or secret managers, never hard-code it.
• Restrict scope — request only the scopes your application actually needs.
• Rotate regularly — regenerate your key periodically or immediately if you suspect it has been compromised.
• Never log keys — ensure your logging pipeline strips Authorization headers before writing to storage.

Authentication Errors

HTTP Status	Code	Meaning
401 Unauthorized	UNAUTHORIZED	Missing or invalid Authorization header / expired key
403 Forbidden	FORBIDDEN	Key is valid but does not have the required scope for this endpoint

When you receive a 401, verify that:

1. The Authorization header is present and formatted as Bearer YOUR_API_KEY.
2. The key has not been revoked or expired.
3. You are sending the request to the correct API host.