API
Authentication
Bearer API keys, created and revoked from the dashboard.
API keys
Create keys at Dashboard → API Keys. Each key is 24 random bytes, base64url-encoded, with the prefix sk-tr-. Give a key a name so it's recognisable in your usage logs; there is no other per-key configuration today (no scopes, no per-key spend caps).
- All keys on an account draw from the same credit balance.
- The plaintext is shown once at creation. If you lose it, create a new key and revoke the old one.
- Rate limits are applied per key. See Rate limits.
Sending the key
Every /v1/* request needs a bearer token in the Authorization header.
curl https://api.thairouter.ai/v1/models \
-H "Authorization: Bearer sk-tr-Ab3xQ…"OpenAI SDKs send this header from their api_key / apiKey option. Never put a key in a browser bundle or a public repo; calls from a browser should go through your own backend.
What we store
| Column | Purpose |
|---|---|
| key_hash | SHA-256 of the plaintext. Lookup on every request. The plaintext is not recoverable from it. |
| prefix | First 10 characters, e.g. sk-tr-Ab3x, so you can tell keys apart in the dashboard. |
| name | The label you chose. |
| last_used_at | Updated at most once a minute per key. |
| revoked_at | Set when you revoke. Revoked keys are refused immediately. |
Revoking a key
Revoke from the dashboard. The row is kept (so historic usage still attributes to it) but the key stops authenticating on the next request. There is no grace period.
Auth failures
| Status | type | When |
|---|---|---|
| 401 | authentication_error | Header missing, not Bearer, wrong prefix, unknown or revoked key. |
| 403 | permission_error | The account that owns the key is suspended. Contact support. |
| 429 | rate_limit_error | Per-key rate limit hit. Honour retry-after. |
Errors share one JSON shape across the API. See Errors.