Authentication
Every API request carries a bearer key. Keys are created in the dashboard, scoped if you want them to be, and revocable instantly.
API keys
Keys look like sk-om-v1-… and are sent as a header on every request:
Authorization: Bearer sk-om-v1-...The secret is shown exactly once at creation; only a hash is stored. Revoking a key on the keys page takes effect immediately.
Per-key limits
- Rate limit: requests per minute, 300 by default, enforced as an exact sliding window. Exceeding it returns 429 with a Retry-After header.
- Cost cap: an optional maximum cost per request. A request whose worst case exceeds the cap is refused before anything is spent.
- Model allowlist: optionally restrict a key to specific models; an empty list means every model.
Keys spend the account’s shared credit balance. There is no per-key balance: limits are the tool for containing an individual key’s blast radius.