Skip to main content
Send your key on every request in the X-API-Key header.
Use exactly that header name. There is no Authorization: Bearer path.

​
Keys

Create and revoke keys on the dashboard keys page.
  • The raw secret is shown once, at creation. Copy it before you close the dialog.
  • Keys do not expire on their own; they stay valid until you revoke them.
  • Revoking a key takes effect promptly, after which it returns 401.
Keep keys server-side. Do not ship them in browser bundles, mobile binaries without a backend broker, public repos, logs, screenshots, support threads, or model prompts. A leaked key can spend your whole quota until you revoke it.

​
When a key fails

A request with no key returns 401 missing_api_key; a request with an unknown or revoked key returns 401 invalid_api_key. Neither is retryable — fix the header or issue a new key rather than retrying. For the full error surface, including rate limits and refusals, see Error codes.