Authentication
Every gateway request is authenticated with a Bearer token. Keys are created in the dashboard and can be scoped down to individual models and networks.
Send your key
Authorization: Bearer $EXOSAI_API_KEYCreate a key in Dashboard → API Keys → Create key. Store the secret in your secret manager. The authenticated dashboard also provides an audited Reveal action for recovery.
Scope a key to what it needs
| Field | Type | Notes |
|---|---|---|
name | string | Label shown in the dashboard, e.g. "prod-worker". |
description | string | Free-form note about where the key is used. |
expiresInDays | number 1–365 | Key stops working automatically after this many days. |
allowedModels | string[] | Allowlist of model ids. It can only narrow what the account can reach, never widen it. |
ipCidrs | string[] | Only these networks may use the key. Requests from anywhere else get 403 ip_not_allowed. |
Key lifecycle
- Rotate — issues a new secret and kills the old one immediately; the scope carries over.
- Reveal — shows the stored secret again for recovery. The action is audited, so use it sparingly.
- Revoke — permanently disables the key. Its next request fails with
401.
All three live in Dashboard → API Keys. Key management is session-authenticated and private to the dashboard — it is not part of the public gateway surface.
An account can hold up to 10 active keys. Rotate on a schedule, revoke the moment a key leaves your infrastructure, and give CI and production separate keys so one can be killed without touching the other.