Authentication
Every API request must carry a valid API key in the Authorization header.
Header format
Authorization: Bearer gw-your-key-hereKey format
API keys follow the pattern gw-{name}-{hash}:
gw-— fixed gateway key prefix{name}— the name you gave the key{hash}— 64 hex characters (SHA-256)
The full key is shown only once, at creation. Only its SHA-256 hash is stored.
What a key can do
| Feature | Description |
|---|---|
| Model allowlist | Restrict which models the key may call (allowed_models) |
| Spending cap | Set a maximum spend per key, with optional automatic reset (daily / weekly / monthly) |
| Expiry | Give the key an expiry date (expires_at) |
| Enable / disable | Revoke access immediately without deleting the key |
Error responses
| Status | Code | Meaning |
|---|---|---|
| 401 | UNAUTHORIZED | Missing or invalid API key |
| 403 | FORBIDDEN | Key is disabled or expired, or the requested model is not on its allowlist |
| 403 | INSUFFICIENT_BALANCE | Account balance is zero |