Docs/Get started

Authentication

API keys, the headers that carry them, rate limits per key, and how to keep keys safe.

Every request needs an API key from the API keys page of your dashboard. Keys look like qck_ followed by 32 characters.

#Sending the key

Use whichever header your client sends; both work on every endpoint.

curl "https://osarai.xyz/v1/models" -H "Authorization: Bearer $OSARAI_API_KEY"

#What a key can reach

A key belongs to your account and reaches only your own running instances. When several of your instances run different models, the model field picks one; when only one model runs, any model name reaches it, which helps tools that send their own model names.

To send a request to one specific instance, add its id from the dashboard:

curl "https://osarai.xyz/v1/chat/completions" \
  -H "Authorization: Bearer $OSARAI_API_KEY" \
  -H "X-Instance-Id: a1b2c3d4e5" \
  -H "Content-Type: application/json" \
  -d '{"messages": [{"role": "user", "content": "Hi"}]}'

#Rate limits

Each key allows 120 requests per minute by default; choose 1 to 600 when you create it. Over the limit the API answers 429 with a Retry-After header. Tokens are not limited: your instance serves as fast as its GPU allows.

#Keeping keys safe

• Store keys in environment variables or a secrets manager, never in source code.
• Use one key per tool or machine, so you can revoke one without breaking the others.
• Revoke a key from the API keys page as soon as you suspect it leaked. Revoked keys stop working within a minute.
• An account can hold 20 active keys.