Getting started
Authentication
Every request carries one of your API keys, in either header, on any format.
Sending the key
Both headers work on every route of the three formats. Use whichever your client sends by default:
Authorization: Bearer sk-unal-…Other headers your client may send, like anthropic-version or OpenAI-Organization, are accepted and ignored.
Managing keys
- Create as many keys as you need in Dashboard → API keys, for example one per app or per machine.
- A key is shown once, at creation. We only keep a hash of it, so a lost key cannot be shown again: create a new one.
- Revoking a key takes effect immediately. Requests using it get a
401. - All keys draw from the same balance. Usage is reported per day, not per request.
Keeping keys safe
- Never put a key in front-end code or a public repository. Call the API from your server.
- Read it from an environment variable or a secret manager.
- If a key leaks, revoke it and create a new one. Anyone holding it can spend your balance.