Skip to main content
Send one API key header with each request. ThinkFeel accepts either the x-api-key header or an OpenAI-style bearer token. Generate keys yourself after onboarding is approved. API-key billing is the standard path, so send one key header on every request. Payment challenges only appear on allowlisted self-serve endpoints or personas when Curve Labs enables that option for your account.

​
Supported API key headers

For OpenAI-compatible clients, send your key as Authorization: Bearer. The x-api-key header is still supported for direct ThinkFeel requests.

​
Environment variables

SDK and CLI projects should use:
VariableRequiredNotes
THINKFEEL_API_KEYYesAPI key created in Playground, through CLI login, or by the ThinkFeel Plugin
THINKFEEL_PERSONA_IDYesPersona UUID provided during onboarding
THINKFEEL_BASE_URLNoOrigin only, such as https://playground.curvelabs.org
OpenAI-compatible clients should point their client base URL to https://playground.curvelabs.org/api/v1. Depending on the client library, you may need to store the same key as OPENAI_API_KEY.

​
CLI login and profiles

thinkfeel login is the preferred way to set up keys for approved Playground users. It opens browser sign-in, creates a Playground API key after confirmation, encrypts the key to a local callback, and saves it in the ThinkFeel CLI profile without printing the unencrypted key.

​
Agent-assisted setup

Codex and Claude Code users can install the ThinkFeel Plugin from CLI + Agents. The plugin does not run npx thinkfeel login; it uses its own local helper with the same Playground browser approval flow, confirms the local env-file destination, then writes THINKFEEL_API_KEY and optional THINKFEEL_PERSONA_ID without exposing plaintext in chat.

​
Non-interactive configuration

Use --api-key-env or --api-key-stdin for automation. Passing API keys as command arguments is intentionally unsupported because shell history and process lists can expose them.
Never expose your API key in client-side or public code. Store API keys as environment variables or managed secrets, rotate keys periodically, and use HTTPS for all requests.