Skip to content
InferencePassInferencePass

Authentication

API traffic uses a project-scoped customer API key in the Authorization header.

Authorization: Bearer $INFERENCEPASS_API_KEY

Keys belong to a workspace project and carry an environment, scopes, model policy, optional IP restrictions, and optional expiry. The gateway resolves the project and policy server-side before pricing or reservation. Never put a long-lived key in browser JavaScript, a mobile bundle, source control, or a documentation example.

Dashboard and playground sessions

The authenticated playground does not expose a long-lived API key. The web server creates a short-lived credential scoped to the selected project and model, sends the request through /v1/chat/completions, and revokes the credential after the response is consumed. Playground requests still run through normal authentication, capability gates, limits, usage normalization, and billing.

Key hygiene

  • Use a test key for local development and a live key only in a server-side secret manager.
  • Give keys the narrowest scope and model allowlist needed by the service.
  • Rotate after suspected exposure; revocation is immediate for future requests.
  • Treat request IDs and error bodies as safe operational metadata, not credentials.

Authentication errors

Missing or malformed credentials return 401 invalid_api_key. Revoked and expired credentials return 401 key_revoked and 401 key_expired. A valid key without the required project, scope, model, or environment access returns 403 permission_denied.

See errors for the full normalized envelope.