Create an API key to authenticate your requests to fal
Most requests to fal require authentication. You need an API key to call any model on the Model APIs, deploy your own with Serverless, or access any private or shared endpoint. The only exception is endpoints deployed with app_auth = "public", which accept unauthenticated requests.API keys are tied to accounts, not people. If you are working under a team, the key belongs to that team and all members share it. The fal client libraries read your key automatically from the FAL_KEY environment variable, so once it is set, every SDK call and CLI command authenticates without extra configuration.
import fal_client# The client automatically reads FAL_KEY from environment# Or you can set it explicitly:import osos.environ["FAL_KEY"] = "your-api-key-here"
Best practice: Use environment variables instead of hardcoding keys in your code. This keeps your keys secure and makes it easy to use different keys for development and production.
When creating a key, you’ll choose a scope that controls what the key can access:
Scope
Use Case
API
Calling any model on fal, including Model APIs and your own deployed endpoints. Also grants access to API-scoped Platform APIs.
ADMIN
Everything in API, plus CLI operations (fal deploy, fal run), managing apps, and accessing admin-scoped Platform APIs. Use this for Serverless deployments.
If you’re not sure which to choose, start with API scope. You can always create an additional ADMIN key later if you need to deploy models.
If you’re part of a team, make sure to select your team in the top-left corner of the dashboard before creating a key. Keys are scoped to the account (personal or team) that created them.