Authentication

Create, store, rotate, and use your API keys.

The public inference API uses a SimpleLLM API key in the HTTP Authorization header. A dashboard login session is not a replacement for that key.

Create and use a key

1. Sign in to the dashboard.
2. Open API Keys and create a named key for the application.
3. Copy the secret when shown and store it in your application's secret configuration.
4. Send the key with each request.

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

The Content-Type above is for JSON requests. Audio uploads use multipart form data, and GET requests do not need a JSON body.

Store credentials safely

Use environment variables or a secret manager on your backend. Never embed a secret in a frontend bundle, public repository, URL query string, screenshot, or support report.

export SIMPLELLM_API_KEY='YOUR_API_KEY'
curl --fail-with-body https://api.simplellm.eu/v1/keys/current \
  -H "Authorization: Bearer $SIMPLELLM_API_KEY"

This read-only endpoint returns metadata for the key used to authenticate; it does not return the secret again.

Separate applications and environments

Use separate keys for development and production and for different integrations. That makes key-specific usage easier to attribute and lets you revoke one integration's credential without changing all applications.

Account-level limits still apply across keys. Creating more keys does not create more account capacity.

Rotate a key

Create a replacement key, update the application's secret, verify a small request, then revoke the old key in the dashboard. Do not revoke the old key before the application has switched unless it is compromised and immediate revocation is necessary.

Authentication failures

401 indicates missing or invalid credentials. Check the full header, whitespace, the selected environment, and whether the key was revoked. A 402 is a credit problem, not a malformed authentication header.

See troubleshooting for other failures and API key metadata for returned fields.