Docs/Start/Authentication

Authentication

One secret per key, sent as a Bearer token. Keys can be scoped and capped.

Authorization: Bearer vk-3f9a••••••••••••
active
keyci-bot
rate limit60 / min
spend cap
$1.84 spent$5.00 cap
allowed models
venym/qwen-27b
venym/glm-flash
revoke
allowed_models: ["qwen-27b", "glm-flash"]

Sending the key

Keys look like vk-.... Send them in the standard header:

HTTP
Authorization: Bearer vk-...

Clients that cannot set Authorization may use the alternative header instead:

HTTP
x-api-key: vk-...

The Authorization header wins if both are present. The same rule covers every key-authenticated route: chat completions, search, scrape and balance.GET /v1/models is public and needs no key.

GET /v1/balancecURL
curl https://venym.io/v1/balance -H "x-api-key: $VENYM_API_KEY"

How keys are stored

We keep a hash of the key, not the key. That is why the secret is shown once at creation. If you lose it, revoke it and make a new one. A revoked key stops working immediately.

Key scoping

Set these when you create a key, or edit them later in Dashboard, API keys.

rpm limitinteger, optional
Requests per minute for this key. If unset, your plan default applies. See rate limits.
spend limitUSD, optional
Lifetime spend cap for the key. Once spent reaches the limit, chat requests fail with 402 key_spend_limit. Reset the counter from the dashboard to reopen it.
allowed modelslist, optional
If set, the key may only call these model ids. Anything else returns 403 model_not_allowed. Empty means all models.

Failure modes

  • No key sent: 401 with code missing_key.
  • Unknown or revoked key: 401 with code invalid_key.
  • Account suspended: 403 with code suspended.

Full list on the errors page.

Browser use

The API sends permissive CORS headers (authorization, content-type and x-api-key allowed), so it works from a browser. Do not ship a key in public front-end code: anyone can read it. Put a spend limit on any key that has to live client-side.