Authentication and API keys

Sending your key

Every request carries your API key in a header. Either form works:

Authorization: Bearer sk_xxx
x-api-key: sk_xxx

A missing or invalid key returns 401 unauthorized.

GET /v1/models is public and needs no key.

Key settings

On the API keys page of the console, each key can have its own:

• Expiry: the key stops working after this date.
• Allowed models: only these models; any other returns 403 forbidden.
• IP allow-list: only requests from these IP addresses are accepted.
• Spending limit: the most this key may spend in total, in dollars. Past it, requests return 402 key_quota_exceeded.
• Route preferences: sort order, routes to skip, exception rules by parameter, and a maximum price per task. See Routes and routing.

Keeping keys safe

• Use keys on your server only. Never put them in web pages, apps or public repositories.
• Give each project its own key, so you can limit or revoke it separately.
• If a key may have leaked, delete it and create a new one.