Authentication and Keys
Authentication Methods
All APIs use Bearer Token authentication. Include your API token in the request header:
Authorization: Bearer sk-xxxxxxxxxxxxxxxxTokens are created and managed on the console Tokens (API Keys) page.
Token Capabilities
When creating a token, you can configure the following as needed:
| Configuration Item | Description |
|---|---|
| Name | Helps distinguish usage purposes (e.g. prod-app, test) |
| Quota Limit | The maximum quota this token can consume; requests are rejected after it is exceeded |
| Expiration Time | Automatically becomes invalid when it expires, suitable for temporary authorization |
| Model Group | Restricts the range of models this token can call |
| IP Allowlist | Restricts the source IPs allowed to call it (optional) |
One account can create multiple tokens. It is recommended to split them by environment/project to make usage statistics and revocation easier.
Security Recommendations
- Keep secrets only in server-side environment variables or secret management services; do not put them in frontend code or public repositories;
- Use different tokens for different projects so that only a single token needs to be revoked if it is leaked;
- Set a smaller quota limit and expiration time for test tokens;
- When abnormal usage is detected, disable the token in the console first, then investigate the source of the calls.
Common Authentication Errors
| HTTP Status | Meaning | Handling |
|---|---|---|
| 401 | Missing or invalid key | Check whether the Authorization header and key are complete |
| 403 | Token disabled / the group does not have permission to access this model | Check the token status and model group |
| 429 | Rate limit triggered or quota insufficient | See Rate Limits and 429 |