Send your key as a Bearer token on every request:
A missing key returns 401 missing_api_key; an invalid, expired or revoked key returns 401 invalid_api_key.

​
Key types

The two kinds are not interchangeable: an API key cannot call /v1/organization/**, and an admin key cannot make model calls. Only the organization owner can create admin keys.

​
Projects

Every API key belongs to a project. Files, generations and webhooks are scoped to projects, and an API key can only see the generations it created itself. Archiving a project immediately disables all of its API keys.

​
Spending limits and expiry

When you create an API key you can set:
  • credit_limit_usd: the most this key may spend in total. Once reached, calls return 402 api_key_limit_reached. Calls running at the same time may take spending slightly past the limit.
  • expires_at: after this time the key stops working.
Keys are shown once, when created. GEEKIDEA stores only a hash and the first characters (redacted_value), so a lost key cannot be recovered. Delete it and create a new one.

​
Keep keys secret

Never put keys in client-side code or public repositories. Call the API from your server, and use a separate project and key for each environment.