Authentication

Authenticate inference requests with a scoped API token. Tokens are created in the console, shown once, and sent as Bearer credentials.

Create a token

API tokens belong to your account and are independent of your console session. You can create as many tokens as you need for different services and environments.

1
Open Dashboard → Tokens
From the console sidebar, choose API tokens.
Go to tokens →
2
Create a token
Give it a descriptive name such as “production-api” or “local-dev”. Names are for your reference only.
3
Copy the secret immediately
The full token is revealed exactly once. Only a prefix and last four characters remain visible afterwards.

Tokens use the form sk_live_xxxxxxxx. Treat a token exactly like a password.

Authenticate requests

Send the token in the Authorization header on every inference request:

Authorization header

Authorization: Bearer sk_live_xxxxxxxx

authenticated-request

curl https://inferenceapi.wethinkdigital.solutions/v1/models \
  -H "Authorization: Bearer sk_live_xxxxxxxx"

For the Anthropic-compatible Messages API, you may also use the x-api-key header. Do not send both.

Model IDs

Model identifiers are platform IDs returned by GET /v1/models. They are not external endpoint hostnames or internal deployment names. Always read the current list from the API or Dashboard → Models instead of hard-coding an identifier you found elsewhere.

Rotation & revocation

You control token lifecycle entirely from the console.

Rename a token to keep environments clear. Renaming does not invalidate the secret.
Rotate when a secret may have been exposed. Rotation returns a new secret once and invalidates the old one at the same time.
Revoke tokens that are no longer used. Revocation is immediate and irreversible.
Expiry is displayed when a token has a time limit. An expired token cannot be used, even if it has not been explicitly revoked.

Rotate before you deploy the replacement

A safe rotation sequence is: create the new token, deploy it to all consumers, verify traffic, then revoke the old token. Rotating an existing token invalidates the old secret immediately.

token-visibility

sk_live_xxxxxxxx        ← shown once at creation
sk_live_xxxxxxxx        ← prefix + last four are retained
Authorization: Bearer sk_live_xxxxxxxx

Console sessions vs API tokens

Credential	Used for	Transport
Console session	Dashboard, usage, billing, token management	HttpOnly session cookie
API token	Inference API requests from your servers	Authorization: Bearer

Console cookie auth is never used for inference. Conversely, API tokens cannot access account-management endpoints. This separation limits the blast radius if either credential leaks.

Authentication errors

Authentication failures return a JSON error with a stable code. Do not log the token itself when reporting failures.

Status	Code	Meaning
401	invalid_token	The token is unknown, expired, or revoked.
401	missing_token	No Authorization or x-api-key header was supplied.
403	token_forbidden	The token is valid but not permitted for this resource.

Error envelope{ error: { code, message, requestId } }

All documentation Create an API token →