Authentication

Use a Bearer key#

External applications authenticate with an API key in the Authorization header. Browser access to your developer console uses a login session instead. A login cookie is not a replacement for your application key.

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

Account and key boundaries#

Every operation belongs to an account. A key can only access that account’s resources and the actions allowed by its scopes. Guessing another task ID never grants access.

Current scopes include generations:write and usage:read. Revoking a key blocks subsequent authenticated calls. Before paid provider execution opens, key budgets must also include settled spending and outstanding reservations; a configured budget field alone is not enforcement.

Rotate without losing history#

• Create a replacement key, update your server, verify access, then revoke the old key.
• Revocation does not cancel in-flight tasks or refund completed work. Use the console or another authorized key to follow existing tasks.
• Never include a full key when sharing logs or asking for help. Share the request ID instead.