> ## Documentation Index
> Fetch the complete documentation index at: https://docs.antarah.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Project API keys for inference, Admin API keys for policies and administration.

Antara has two kinds of API keys. Both are shown in full only once, when you create them.

| Key | Format | Use it for | Create it in |
| - | - | - | - |
| **Project API key** | `ak_` + 43 characters | Inference: `/v1/chat/completions`, `/v1/responses`, `/v1/messages`, `/v1/messages/count_tokens`, `/v1/models`, `/v1/credits` | The project's **API keys** page |
| **Admin API key** | `ak_admin_` + 43 characters | The Policy and Admin APIs under `/v1/organization/…` | The organization's **Admin keys** page |

## Sending a key

```bash Bearer (all endpoints) theme={null}
curl https://api.antarah.dev/v1/models -H "Authorization: Bearer $ANTARA_API_KEY"
```

```bash x-api-key (inference only) theme={null}
curl https://api.antarah.dev/v1/messages \
  -H "x-api-key: $ANTARA_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{"model": "a1", "max_tokens": 256, "messages": [{"role": "user", "content": "Hi"}]}'
```

Inference endpoints accept `Authorization: Bearer` or `x-api-key`, so both SDKs work unchanged. If you send both, `Authorization` wins.

A key of the wrong kind fails with a message naming the right one: `401 invalid_api_key` on inference, `401 invalid_admin_credential` on management endpoints.

## Project API keys

A project key belongs to one project. Its usage counts toward that project's spend limit and rate limits. By default it has all three inference permissions:

| Permission | Grants |
| - | - |
| `inference` | Chat Completions, Responses, Messages, count tokens |
| `models:read` | `GET /v1/models` |
| `credits:read` | `GET /v1/credits` |

Archiving a project revokes all of its keys. Requests with a revoked or expired key get `401 invalid_api_key`.

## Admin API keys

An Admin API key acts for the whole organization, with any subset of these permissions. You can only grant permissions you have yourself.

| Permission | Grants |
| - | - |
| `organization:read` | Read the organization |
| `projects:read` | List and read projects |
| `projects:create` | Create, rename, and archive projects |
| `project_api_keys:read` | List and read project keys |
| `project_api_keys:create` | Create project keys |
| `project_api_keys:revoke` | Revoke project keys |
| `admin_api_keys:read` | List and read Admin API keys |
| `admin_api_keys:create` | Create Admin API keys |
| `admin_api_keys:revoke` | Revoke Admin API keys |
| `billing:read` | Balance, usage, and costs |
| `spend_limits:read` | Read spend limits |
| `spend_limits:write` | Set and remove spend limits |
| `policies:read` | List and read policies |
| `policies:write` | Create, edit, publish, pause, resume, and delete policies |

A missing permission gets `403 permission_denied`.

## Keeping keys safe

* Keep keys on your server. Anyone with a key can spend your credits.
* Use one key per app or environment, so you can revoke one without touching the others.
* Revoke a leaked key at once in the console, then create a new one.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.