Authentication

Every API request carries a bearer key.

View as MarkdownSuggest a change on GitHub

Keys are created in the dashboard, scoped if you want them to be, and revocable instantly.

You need an account.

API keys

Keys look like sk-om-v1-… and are sent as a header on every request:

Authorization: Bearer sk-om-v1-...

The secret is shown exactly once at creation; only a hash is stored. Revoking a key on the keys page takes effect immediately.

Per-key limits

Rate limit: requests per minute, 300 by default, enforced as an exact sliding window. Exceeding it returns 429 with a Retry-After header.
Spend limit: an optional USD budget per day, week or month, or for the key’s lifetime. Settled charges plus active holds count against it; once reached, requests return 403 key_spend_limit_exceeded until the window resets.
Cost cap: an optional maximum cost per request. A request whose worst case exceeds the cap is refused before anything is spent.
Expiry: an optional expiresAt timestamp after which the key stops authenticating.
Model allowlist: optionally restrict a key to specific models; an empty list means every model.

Keys spend the account’s shared credit balance. There is no per-key balance: limits are the tool for containing an individual key’s blast radius.

A key’s scopes limit which endpoint families it may call. Valid values: CHAT COMPLETIONS RESPONSES EMBEDDINGS DECISIONS IMAGES VIDEOS AUDIO_SPEECH AUDIO_TRANSCRIPTIONS AUDIO_GENERATIONS MUSIC WORKFLOWS BILLING_READ "*". Calling outside a key’s scopes returns 403 insufficient_scope.

Details for expertsEditing keys

Editing keys

Name, spend limit, cost cap and expiry are editable after creation on the keys page. An omitted field stays unchanged; an explicit null clears it. Scopes, the model allowlist and the rate limit are fixed at creation; mint a new key to change them.

Keys are managed with your browser session on the dashboard; they cannot be created or edited with another API key.