Authentication

The inference API authenticates with a Bearer token. Keys belong to an organization, not to a person. Create and revoke them in the dashboard.

Admin authority is required to create or revoke keys.

Create a key

Organization admins open APIs and create a key. The plaintext is shown at creation. Store it as ASTORIAS_API_KEY in the secret manager you already use for production. Members can use the dashboard and playground but cannot create or revoke keys.

Format

Keys start with ast_ followed by 64 hexadecimal characters.

Name

Optional, up to 64 characters. The default name is Default.

Revoke

Revocation is one-way and takes effect immediately. The next request with that key returns 401.

Rotate on offboarding

Removing a member stops dashboard access. It does not invalidate keys they already copied. Revoke those keys and create replacements.

Send the key

Every authenticated request uses this header:

header

Authorization: Bearer ast_<64-hex-characters>

A missing, malformed, unknown, or revoked key returns 401 with code unauthorized. See Errors.

Verify a key

GEThttps://api.astorias.ai/v1/auth

Confirms the key is active and returns the organization id. It is free: it consumes no rate limit and no credits.

terminal

curl https://api.astorias.ai/v1/auth \
  -H "Authorization: Bearer $ASTORIAS_API_KEY"

Success looks like { "ok": true, "organizationId": "..." }.