Authentication & keys

Console sign-in

Sign in with a one-time email verification code or Google. A verified account can create its own organization. Access to an existing team requires membership or a valid invitation.

Verification codes are temporary and can be used once. Do not share them. When joining a team, use the invited email address.

API authentication

Every API endpoint under /v1, including the model catalog, requires a bearer key created in your organization.

Authorization: Bearer rl_live_YOUR_ORGANIZATION_KEY
Content-Type: application/json

These are cheapinference.dev keys, not upstream OpenAI credentials. Your account never needs access to our upstream provider key. We store only a SHA-256 hash of each API key and cannot recover the secret.

Create and scope a key

1. Select the correct organization in the console.
2. Open API keys and give the key a descriptive name, such as “production-api” or “staging-worker”.
3. Optionally set a monthly usage limit in USD of usage value. The limit resets on the UTC calendar month and includes in-flight reservations.
4. Copy the secret once and store it on your server. Create separate keys for separate integrations.

Rotate or revoke credentials

Create a replacement key, update your server’s secret manager, deploy the updated configuration, and revoke the old key. New requests re-check revocation against the database. Requests already in flight may complete and are still metered.

Only owners and admins can create or revoke keys. Members can view masked identifiers. If a key is exposed, revoke it immediately and inspect recent usage.

Authentication errors

A missing, malformed, unknown, or revoked key produces 401. An organization on hold can produce 403. Console session cookies do not authenticate inference API calls.

Never include a key in a URL. URLs can appear in browser history, referrers, and infrastructure logs.