All API requests must include a Bearer token in the Authorization header. Keys are scoped to a single account and can be revoked at any time.
Authorization: Bearer sk-bs-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Key types
| Type | Prefix | Scope |
|---|---|---|
| Secret key | sk-bs- | Full access to inference endpoints and usage reads |
| Read-only key | ro-bs- | Usage and balance reads only, cannot create completions |
Security practices
- Create one key per environment (dev, staging, production) so you can rotate independently.
- Set an optional monthly spend cap per key to bound the blast radius of a leak.
- Rotate keys immediately if they appear in logs, screenshots or public repositories.
- Never call the API directly from a browser or mobile app — proxy through your own backend.
We never store your key in plaintext. Only a SHA-256 hash is persisted, which is why a lost key cannot be recovered — only replaced.
技术文档以英文维护。