Send your key as a bearer token on every request. Keys are created in the console and carry their own limits — a spend cap, an expiry, and optionally an allowlist of models they may call.
Header
Authorization: Bearer sk-your-key
What a key can reach
| Surface | Path prefix | Accepted credential |
|---|---|---|
Model API | /v1, /v1beta | API key (sk-…) |
Organization API | /api/organization | Access token, plus membership of that org |
The two are separate. An sk- key calls models and cannot administer your organization; the organization routes take your account's access token and additionally check your role there. Any member may read; anything that moves money, changes membership or issues keys requires an owner.
Per-key restrictions
- Spend cap — the key stops working once it has consumed its allotted quota.
- Expiry — an absolute time after which the key is refused.
- Model allowlist — leave it empty to allow every model you have access to, or name specific models to fence the key in.
- Group — selects which pricing group the key bills against, where the instance offers more than one.