Authenticate API requests
Use a platform API key with the Bearer authorization header.
Last updated on
Create and save a key
Open API keys in the cabinet, check that the correct workspace is active, and create a key named after the server or project that will use it. The complete key is shown once. Later, the cabinet shows only its name and masked prefix, which is safe to use when identifying the key to support.
Save the complete key immediately in a server environment variable or secret manager:
export PROVOD_API_KEY="sk_..."Keep the key out of browsers
Never put a platform key in frontend source, a public browser bundle, a repository, screenshots, or support messages. Browser code should call your authenticated backend; that backend calls provod.ai.
Bearer authentication for public API formats.
Send the key as Bearer authorization
The API reads the key from the Authorization header. Verify it with model discovery before configuring an SDK or coding tool:
curl --fail-with-body --silent --show-error https://api.provod.ai/v1/models \
-H "Authorization: Bearer $PROVOD_API_KEY"A successful response has object: "list" and a data array. Choose an available model and copy its exact id; do not keep a model list copied from an old guide. The catalog can also explain that a model is unavailable to the active workspace.
Separate projects and rotate safely
Use a separate key for each project or server. This makes its usage, spend limits, and revocation independent.
If a key is lost, exposed, or no longer needed, revoke it in the cabinet. For rotation without downtime, create a replacement, update the server secret, repeat GET /v1/models with the replacement, and only then revoke the old key. A revoked key cannot be restored.
Prepare safe diagnostics
A public error code is the client-facing value such as error.code in an API error response. Record that code, the HTTP status, endpoint, model ID, approximate time with timezone, and the masked key prefix. Never include the complete key or sensitive request content.