# Authentication

Send `Authorization: Bearer <key>` on generation, task and key requests. Model catalog GET endpoints permit anonymous public pricing; an optional valid key selects account pricing. Never place keys in query strings, public repositories, client bundles, shared screenshots, or browser storage. Create a real key in an authenticated, verified console account.

A live key will be shown once at creation. Subsequent views show its prefix/suffix and immutable ID. The server stores a keyed one-way digest, not recoverable plaintext. Key management requires a console session; an inference key cannot mint other keys or change account billing.

To rotate a key: create a replacement, deploy it, confirm traffic, then revoke the original. Pause is reversible; revocation is permanent. Expiry is evaluated in UTC on each new request. Already accepted tasks retain their billing and history after pause, expiry, or revocation. Use another authorized key from the same account or the console to inspect them.

`GET /v1/key` returns metadata for the current key, including effective restrictions and remaining spending allowance. It never returns the secret. Errors do not reveal whether a guessed key belongs to another account.

[Key controls](/docs?page=keys&lang=en) · [Errors](/docs?page=errors&lang=en)