Authentication
Send your API key with each request, and handle keys safely.
Send your API key as a bearer token in the Authorization header of every request.
curl https://api.avey.ai/llm/models \
-H "Authorization: Bearer $AVEY_API_KEY"You need an API key
Key format
Keys start with avey_sk1_, then 52 characters, _, and a 7-character checksum.
avey_sk1_2A6J5GM2LAXHXHIOU2M77OPFOP2XC4LE3XGORIXVSO2JHGCVZCXQ_FS5FY7QA key that was cut short or altered when you copied it returns 401 with
invalid API key.
Create and manage keys
Create keys on the API keys page of the API platform. Give each key a name and an expiry: 30 days, 90 days, 180 days, one year, or a date you pick. The full key is shown once, when you create it. The platform keeps only a hash, so a lost key cannot be recovered. Create a new one.
| Action | What happens to the old key |
|---|---|
| Regenerate | Stops working. The new key has the same name. Update your integrations. |
| Revoke | Stops working. It stays in the list as revoked. This cannot be undone. |
| Delete | Stops working and leaves the list. This cannot be undone. |
| Let it expire | Returns 403 with API key expired from the expiry date on. |
Every key on your account shares the same rate limits and the same credit balance. A second key does not add capacity. See Rate limits.
Use the OpenAI SDKs
The OpenAI SDKs send this header already. Pass the key as api_key and set
nothing else.
import os
from openai import OpenAI
client = OpenAI(
base_url="https://api.avey.ai/llm",
api_key=os.environ["AVEY_API_KEY"],
)Handle keys safely
- Call Avey from your server. A key in browser or mobile code is a public key.
- Keep keys out of source control. Store them in environment variables or a secrets manager.
- Use one key per application, so you can revoke one without affecting the others.
- Rotate a key if it may have been exposed.
Authentication errors
A missing key returns 401 with missing credential. A malformed or unknown
key returns 401 with invalid API key. A revoked or expired key, or an
account without API access, returns 403. Both bodies use the simple
{ "message": ... } shape. The messages, and what to do about each, are in
Errors.