Search the documentation

Pick a page and open it with Enter.

Authentication

Create, rotate, and safely store API keys.

Locally the backend trusts localhost and needs no key. The moment you expose it, an API key becomes the ticket in — sent as a bearer token in the Authorization header.

When keys are required

Key checks are off by default so a plain curl against your own machine keeps working. Start the backend with REQUIRE_API_KEY=true and the inference endpoints (chat, transcribe, vision) begin turning away anyone without proof: either an open session — that is your own frontend — or a valid API key.

bash
REQUIRE_API_KEY=true

Create a key

Keys belong to your account. Open Settings → API keys, create one, and copy it right then — the full key is shown exactly once. Afterwards only a hash lives in the database, so nobody, not even the server, can show it to you again. Lose it and you revoke it and make a new one.

Every key starts with sk_smee_ so a leaked one is easy to spot. Delete a key to revoke it immediately; deleting your account takes all of its keys with it.

Send it with a request

bash
curl -N http://localhost:8000/api/v1/chat/stream \
  -H "Authorization: Bearer sk_smee_…" \
  -H "Content-Type: application/json" \
  -d '{"messages":[{"role":"user","content":"Hello!"}]}'
Authorizationheaderrequired

Bearer followed by your secret key. Required on inference endpoints once REQUIRE_API_KEY is on.

X-Session-Idheader

The frontend's own way in — its session, forwarded automatically. You won't set this by hand.