Authentication

Every request needs an API key. Keys are io-sk- followed by 43 letters and digits, and they belong to an organization. Requests made with a key draw from that organization's balance.

Sending the keyCopy Anchor Link

The API accepts the key in either header. Use whichever your SDK sends.

Both headers work on every endpoint, including /v1/messages. If a request carries both, x-api-key is used.

curl https://api.interodin.com/v1/models \
  -H "Authorization: Bearer $INTERODIN_API_KEY"

Creating and revoking keysCopy Anchor Link

Create keys in the console. A key is shown once, when you create it. We store only a hash, so we can't show it again. If you lose a key, revoke it and create a new one.

Revoking takes effect on every server within a minute, usually within seconds. After that, requests with the key fail with 401 invalid_api_key.

Limiting a keyCopy Anchor Link

When you create a key you can limit it:

• Monthly spend limit. Once the key has spent this much in a calendar month (UTC), its requests fail with 403 key_spend_limit_reached until the next month. Other keys keep working.
• Allowed models. Requests for any other model fail with 403 model_not_allowed. GET /v1/models lists only the allowed models.

Give each app, environment or teammate its own key. Usage and logs in the console are broken down per key, and you can revoke one without touching the others.

Keeping keys safeCopy Anchor Link

• Keep keys on the server. Never ship a key in a browser bundle, mobile app or public repository. The API doesn't accept browser (CORS) requests from other sites anyway.
• Read the key from an environment variable or a secret manager.
• If a key leaks, revoke it in the console at once.

Related errorsCopy Anchor Link

Every response carries an x-request-id header. Quote it when you contact support.

See Errors and rate limits for the full list.