Authentication

Bearer token

Every request to /api/v1/* (except GET /api/v1/models) must include your API key in the Authorization header as a bearer token:

Key lifecycle

Keys are created and managed from your dashboard. The full key is shown only once when it is created; Orux AI stores only its hash. Copy it to a secure location. If you lose it, create a replacement and revoke the old key.

A key can optionally be scoped to a specific model allowlist. If your key is restricted and you call a model outside that list, the request is rejected before it reaches any upstream provider.

Authentication errors

Missing, malformed, or invalid keys all return HTTP 401 with an OpenAI-compatible error body:

Security recommendations

• Never embed your key in frontend/browser code — proxy requests through your own backend.
• Use a separate key per environment (dev / staging / production) so you can revoke one without affecting others.
• Set a model allowlist on keys that only need access to a subset of models.
• Rotate a key immediately if you suspect it has leaked.