Authentication

Every request to /v1 carries a bearer token:

Authorization: Bearer sk-dawn-...

Keys look like sk-dawn- followed by 48 hex characters. The sk- prefix is functional rather than cosmetic: it is what the API dispatches on to tell a key from a browser session. The dawn- segment makes a leaked key greppable and attributable to us, which is the difference between a scanner flagging it and nobody noticing.

Creating a key

In the dashboard. A key is shown once and stored only as a hash, so there is no “show key” button and no support request that can recover one. If you lose it, revoke it and make another.

An API key cannot manage API keys

/api/v1/keys is session-only. A key can spend your balance; it cannot mint replacements, list your other keys, or revoke them.

That asymmetry is the whole point. If a key leaks, revoking it ends the exposure. If a key could create keys, an attacker would mint a permanent replacement in the seconds before you noticed, and revoking the original would achieve nothing.

Revoking

Immediate. Revocation purges the cached lookup as well as marking the row, so the key stops working on the next request rather than when a 60-second cache expires. A revocation that takes a minute to apply is not a revocation.

What is authenticated where

Surface	Auth	Notes
POST /v1/chat/completions	API key, or a session cookie	The session path exists for the playground and is rate limited separately
GET /v1/models	none	Public. A price list you have to authenticate to read is not a price list
GET /v1/models/{id}	none	Public, same reasoning
/api/v1/*	session cookie	The dashboard’s own surface. Not for programmatic use

Errors

A missing, malformed or revoked key is a 401 with type: "authentication_error" and a WWW-Authenticate: Bearer header. See Errors for the full shape.

A key that is valid but whose account has no balance is a 402, not a 401. The distinction matters: one means “fix your credentials”, the other means “top up”. See Pricing and billing.