Authentication & keys

The website account and the inference API use different credentials. Signing into the website does not authorize an inference request.

Website access

Register with an email address and password, then confirm the code sent to your email. After sign-in, enter an invitation code to activate API access. Invitations determine which models and spending limit are available to the account.

Reading this documentation does not require an account or invitation.

API authentication

Send your API key in the authorization header:

Authorization: Bearer YOUR_API_KEY

Keys are shown once on creation. The workspace subsequently shows only a short suffix. Current keys expire after 30 days; check the exact expiry shown in your workspace.

Keep credentials on your server

Do not embed an API key in browser JavaScript, mobile application assets, screenshots or a public repository. Route application traffic through your own authenticated backend.

Rotate or revoke a key

1. Open API keys in your workspace.
2. Create a replacement key and update your server-side secret.
3. Revoke the previous key.

Revocation blocks the key at the public website ingress immediately, even if upstream cleanup needs to be retried. A revoked, expired or suspended key cannot start new inference requests.

Troubleshooting

A 401 response means the bearer key is missing or inactive. Account suspension and invitation permissions can also prevent access. For other status codes, see errors and limits.