AuthenticationStart

Every call except GET /v1/models needs a key. This page shows you how to send it, which scopes it needs and the order in which a request is checked.

Before you begin

• A key from the dashboard. If you do not have one, follow the Quickstart.
• A list of the endpoints you plan to call, so you can give the key only the scopes they need.

Send your key

Send the key as a bearer token:

Authorization: Bearer kaer_live_...

Or send it in an x-api-key header. When Authorization holds a bearer token, it wins.

Choose scopes

Each scope covers the endpoints listed, and works once your tier reaches the one in Opens at.

Find out why a request was refused

The gateway runs these checks in order and stops at the first one that fails. The error code tells you which check it was.

1. The key exists and is not revoked or expired: else 401 invalid_api_key (no key at all: missing_api_key).
2. The account is active: else 403 account_inactive.
3. The caller's IP is on the key's allow-list, when it has one: else 403 ip_not_allowed.
4. The key has the endpoint's scope: else 403 insufficient_scope.
5. Your tier includes the service: else 403 tier_required.
6. Rate limits: else 429 rate_limit_exceeded.
7. A hold for the call's maximum cost: else 402 (insufficient_credits, monthly_limit_reached or key_budget_exceeded).

To limit a key further with allow-lists, budgets, expiry and rotation, see Key security.