Skip to main content
Every request to the hosted FileRouter service must carry a valid API key. You create this key once through filerouter.dev, then supply it in one of several ways depending on which surface you use. This page covers all three: the Authorization header for direct REST calls, the FileRouterClient constructor option for the TypeScript SDK, and the npx @file_router/cli login command for the terminal.

​
Get an API key

Visit filerouter.dev, sign in, and create an API key from your account dashboard. Keep it secret — treat it the same way you would treat a password.

​
Pass the key in REST requests

Every request to the hosted API must include an Authorization header with your key as a Bearer token.
The REST API enforces this on every endpoint. If the header is missing or the key is disabled, the API returns a 401 response:
Never commit your API key to source control. Use environment variables or a secrets manager to inject it at runtime.

​
Use the key in the TypeScript SDK

The FileRouterClient constructor accepts an apiKey option. If you omit it, the client automatically reads the FILEROUTER_API_KEY environment variable.
index.ts
If neither the option nor the environment variable is present when you construct the client, it throws a FileRouterError with code Auth immediately — before you make any network calls.

​
Log in with the CLI

The CLI uses a browser-based device authorization flow so you never have to copy-paste a key manually. Run login once and the CLI saves your key locally for all future commands.
The device authorization session is closed immediately after the CLI creates your API key. FileRouter does not retain your OAuth token.

​
API key errors

If you receive a 401, check that the FILEROUTER_API_KEY environment variable is set correctly or that the key you created in the dashboard has not been revoked.

​
BYOK mode — no FileRouter key required

If you use BYOK mode, you do not need a FileRouter API key. Instantiate the FileRouter class from @file_router/sdk (instead of FileRouterClient) and supply your provider keys directly, or pass --local to the CLI. Your document goes straight to the provider without touching FileRouter’s infrastructure.