Sending a key
Authorization: Bearer or x-api-key, so both SDKs work unchanged. If you send both, Authorization wins.
A key of the wrong kind fails with a message naming the right one: 401 invalid_api_key on inference, 401 invalid_admin_credential on management endpoints.
Project API keys
A project key belongs to one project. Its usage counts toward that project’s spend limit and rate limits. By default it has all three inference permissions:
Archiving a project revokes all of its keys. Requests with a revoked or expired key get
401 invalid_api_key.
Admin API keys
An Admin API key acts for the whole organization, with any subset of these permissions. You can only grant permissions you have yourself.
A missing permission gets
403 permission_denied.
Keeping keys safe
- Keep keys on your server. Anyone with a key can spend your credits.
- Use one key per app or environment, so you can revoke one without touching the others.
- Revoke a leaked key at once in the console, then create a new one.