Authentication and API keys

Every request carries an API key as a bearer token:

curl https://api.opinference.com/v1/models \
  -H "Authorization: Bearer $OP_API_KEY"

Create a keyCopy Anchor Link

Create keys in the dashboard under API Keys. A key is shown once, when it is created. Store it in a secret manager or an environment variable; it cannot be shown again. If you lose a key, revoke it and create a new one.

Keys for api.opinference.com start with op_live_. When you create a key, choose Live.

ExpiryCopy Anchor Link

A key can be permanent or expire after 90 days, 30 days or 24 hours. Once a key expires, every request made with it is refused with 401 unauthorized. Pick the shortest expiry that fits the job: a short one for a demo or a script you run once, a permanent one for a server you rotate by hand.

Restrict a keyCopy Anchor Link

A key can be limited to a set of models, a set of client IP ranges and a spend cap. See Key restrictions.

When a key is refusedCopy Anchor Link

A missing, unknown, revoked or expired key gets the same answer, so a refusal never tells a caller which keys exist:

{
  "error": {
    "code": "unauthorized",
    "message": "the presented key was not accepted",
    "kind": "terminal",
    "scope": "route",
    "type": "invalid_request_error",
    "param": null,
    "request_id": "req_..."
  }
}

The status is 401. Retrying with the same key will not help.

Three refusals are named, because the key itself is fine and the fix is elsewhere:

See Errors.

Keep keys server sideCopy Anchor Link

A key spends your balance. Never ship one in a browser bundle, a mobile app or a public repository. Call the API from your own server and give each service its own key, so you can revoke one without touching the others.