Authenticate with a Bearer Token

ZhiFlo API uses Bearer authentication. Send the Token in the Authorization header on every request, never in the URL, request body, or application logs.

Header format

Item	Value
Authentication scheme	Bearer Token
Header name	Authorization
Header value	Bearer <YOUR_ZHIFLO_TOKEN>
Content type for POST	application/json

The authentication section of a raw HTTP request looks like this:

Authorization: Bearer <YOUR_ZHIFLO_TOKEN>
Content-Type: application/json

There is one space after Bearer. <YOUR_ZHIFLO_TOKEN> is a placeholder; use an environment variable or the client’s credential store for the real value.

Reference a temporary environment variable

Bash or zsh

Load the Token through hidden input:

read -s ZHIFLO_API_TOKEN
export ZHIFLO_API_TOKEN

Send the request header to curl through standard input:

curl --silent --show-error \
  --config - \
  "https://api.zhiflo.com/v1/models" <<CURL_CONFIG
header = "Authorization: Bearer ${ZHIFLO_API_TOKEN}"
CURL_CONFIG

The expanded Token stays out of the curl process arguments.

PowerShell

Load the Token through a secure prompt:

$secureToken = Read-Host "Paste your ZhiFlo Token" -AsSecureString
$env:ZHIFLO_API_TOKEN = [System.Net.NetworkCredential]::new("", $secureToken).Password

Then create the header:

$headers = @{ Authorization = "Bearer $env:ZHIFLO_API_TOKEN" }

Closing the terminal removes these temporary variables.

Choose the right storage location

• Command-line clients: use a process environment variable or the client’s own credential store.
• Desktop clients: paste the value only into API Key, API Token, or Token credential fields.
• Server applications: use the hosting platform’s secret manager instead of source code or ordinary configuration files.

Never place the Token in a URL query string. URLs can enter browser history, proxy records, and access logs.

Check these items for 401

1. The Token is complete and has no surrounding whitespace or newline.
2. The header is exactly Authorization: Bearer ....
3. The Token is active and has not expired or been revoked.
4. The client did not place it in a different authentication field.

If exposure is possible, revoke the Token first and create a replacement with Token management. Next: Review the complete error map.