Authentication
API keys, scopes, limits and revocation.
API keys
Send the key as a bearer token on every request. Keys start with unr_live_. The full key is never stored; the gateway hashes it and compares hashes, so a database read cannot reveal a key.
Authorization: Bearer unr_live_7x5GLwvDTwcJUIue6Jl0CDicG5A8a2yXWhat a key carries
| Setting | Meaning | Default |
|---|---|---|
| Policy profile | The profile applied to every request made with the key. Follows the latest version unless pinned. | default |
| Scopes | Which endpoints the key may call: chat, completions, embeddings, models. | all four |
| Requests per minute | Token bucket, refilled continuously. | 600 |
| Concurrent requests | In-flight limit. Streams hold a slot until they close. | 16 |
| Expiry | Optional. Expired keys return 401. | never |
Revoking
Revoke from the API keys page. The gateway caches key lookups for 30 seconds, so a revoked key stops working within that window. Create one key per application or environment so revocation is surgical.
Errors
| Status | Code | When |
|---|---|---|
| 401 | invalid_api_key | Missing, malformed, unknown, revoked or expired key. |
| 403 | insufficient_scope | The key lacks the scope for this endpoint. |
Keys in the browser
The Chat page keeps a key in your browser's local storage only. For your own front ends, keep keys server-side and proxy requests, as you would with any provider.
Spot an error or a gap? Tell us — and quote x-request-id if you have one.