API keys

One account-level key works for all of your models. Keys authenticate the serving endpoint and attribute usage for billing.

Keys look like os_4f2a… and are created under API in the dashboard. Give each key a name (per environment or per service), and create as many as you need. The full key is shown once at creation and stored hashed — copy it then, because it can never be displayed again.

Using a key

Send it as a bearer token on every request:

http

Authorization: Bearer os_4f2a9c81d06e37b25a48f19c0e5d7a63

Keeping it secret

Call the endpoint from your server, never from a browser or mobile app. A key in client code is public.
Store keys in environment variables or a secret manager, not in source control.
Usage is billed to your account, so a leaked key spends your money.

Rotation

Create a new key, move your traffic to it, then revoke the old one from the API page. Revocation is instant. Retraining a model never affects your keys.

Suspect a leak? Revoke first, investigate second. Your traffic only needs the new value.