Authentication
Every request carries your key as a Bearer token. There is nothing else to sign.
The header
Send Authorization: Bearer rk_… with every request. The OpenAI SDKs do this when you pass the key as api_key / apiKey.
curl
curl https://api.airuntime.dev/v1/chat/completions \
-H "Authorization: Bearer $TOKENS_PAY_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "your-model-id",
"messages": [{"role": "user", "content": "Say hello in five words."}]
}'Your key
- Keys start with
rk_. Each is a 256-bit random secret; we store only its SHA-256 digest, so we can’t show it again. - It is shown once, right after your first payment. Keep it in an environment variable or a secret manager, never in client-side code or a repository.
- Lost or leaked? On your Profile, turn the key off and get a new one. Your balance stays the same.
Call from your server
The API refuses browser requests from other websites (HTTP 403, authorization_customer_api_origin_denied), because a key in a web page is a key anyone can copy. Call it from your backend, a script or a CLI.
Authentication errors
| Status | Code | Meaning |
|---|---|---|
| 401 | authentication_workspace_api_key_invalid | The key is malformed or incomplete. |
| 401 | authorization_customer_runtime_denied | The key is turned off, expired or wrong. |
| 401 | invalid_api_key | No key, or not an rk_ key. |
| 403 | authorization_customer_api_origin_denied | Called from a browser on another website. |