Auth & API keys

Auth format

Every request must include an API key starting with sk- in the Authorization header:

http
POST /v1/chat/completions HTTP/1.1
Host: api.aicodedog.com
Authorization: Bearer sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Content-Type: application/json

{...}

A missing, malformed, or revoked key returns 401 Unauthorized immediately.

Issue, view, revoke

All key operations live on the API Keys page in the console:

• Issue: click Create key. You can set a label (recommend "prod / dev / CI / experiment"). The full key is shown exactly once in the dialog and is never displayed again after you close it.
• Rotate: create a new key, swap it into your code, verify everything still works, then revoke the old one. The switch is invisible to your app.
• Revoke: click Disable on the key row. Effective immediately — disabled keys return 401 on every subsequent call.
• View: the list only shows the first 4 + last 4 chars (e.g. sk-abcd...wxyz) — enough to identify, never enough to leak.

Permission scope

API keys are tenant-level today — every key under the same account shares one balance and one quota pool. That means:

• Issuing different keys to different team members is for auditing (every call records which key sent it), not quota isolation.
• If you need to bill different customers, use OEM sub-tenants — each sub-tenant has its own balance and its own key pool.

Security best practices

• Never hard-code keys. Read them from env vars, a Secret Manager, Vault, or another runtime source.
• Never ship keys to the frontend. Browser, mobile and desktop code must not hold the key directly — anyone with DevTools can grab it. Front-end calls must go through your own backend proxy.
• One key per environment / service. Prod, staging, CI, and personal dev each get their own — a leak in one doesn't blast-radius into the others.
• Rotate regularly. Recommend every 90 days. (This is a hard PCI / SOC 2 compliance requirement.)
• Monitor unusual usage. Set a daily-cap alert on the console Usage page so you find out about abuse fast.

IP allowlist (optional)

Each key can be bound to a CIDR list — only source IPs inside the list can use it. Ideal for server-side traffic with a fixed egress:

json
{
  "label": "production-api",
  "allowedIps": ["203.0.113.0/24", "198.51.100.42/32"]
}

Calls from outside the list return 403 Forbidden immediately and are recorded in the audit log.