Get started

Authentication

API keys, how to send them and what limits they carry.

Every request to POST /v1/decide carries your API token as a bearer token. GET /health and GET /v1/models need no token.

Authorization: Bearer launchables_...

Getting a token

Create tokens yourself in the console. Every key belongs to a workspace: sign in, open Workspaces, choose one, then open API keys and create a key. The full token is shown once, and an organisation can hold up to 25 active keys. See Console for workspaces, roles and credit. Revoke a key there and the API refuses it within a minute. On your own hardware, tokens are issued by whoever runs the endpoint.

Credit and limits

Hosted keys work once your account has prepaid credit, bought in the console from £5. When the credit runs out, every key on the account pauses and answers 402 with type out_of_credit until you top it up. Automatic top-up keeps them running.

A workspace can also limit its keys. When its monthly budget is reached, they answer 402 with type budget_exceeded. A model the workspace may not use answers 403 with type model_not_allowed. Every code is listed in Errors and limits.

By default each key can make 1,200 requests a minute, with no daily cap. A workspace can set its own per-key limit. Going over returns 429; wait and retry. Ask us if you need a higher limit.

When a token is refused

A missing, wrong, expired or revoked token returns 401 with an error body:

{ "error": "missing or invalid API key" }

Keeping tokens safe

• Keep tokens on your server, in an environment variable or a secret store. Never put one in a web page or a mobile app.
• Use a separate token for each environment, so one can be revoked without stopping the others.
• If a token leaks, tell us and we will revoke it and issue a new one.