Skip to content
Security

Authentication

Authenticate API requests with a bearer API key, and understand what each key can reach.

Bearer authenticationPermalink to Bearer authentication

Authenticated requests carry the API key in the Authorization header. Keys are created in the console and begin with a fixed prefix.

Authorization header
Authorization: Bearer rl_sk_live_YOUR_KEY

Keep keys server-side

A key in browser JavaScript is a public key. Call the API from your own backend and never ship a key to a client you do not control.

What a key can reachPermalink to What a key can reach

A key carries a scope, and the scope decides which routes it authorizes. A key limited to inference authorizes the chat-completions endpoint and nothing else — so a credential handed to a model client cannot read anything about your account.

Organization keys are refused on personal endpoints. If a request that works with a personal key fails with a permission error, check which workspace issued the key.

A first authenticated requestPermalink to A first authenticated request

curl
"tk-cmd">curl https://api.relane.ai/v1/models \
  "tk-flag">-H "Authorization: Bearer rl_sk_live_YOUR_KEY"
JavaScript (fetch)
const res = await fetch(class="tk-str">"https:class="tk-commentclass="tk-str">">//api.relane.ai/v1/models", {
  headers: { Authorization: class="tk-str">`Bearer ${process.env.RELANE_API_KEY}` },
});

if (!res.ok) {
  const { error } = await res.json();
  throw new Error(class="tk-str">`${error.type}: ${error.message}`);
}

const { data } = await res.json();
console.log(data.map((m) => m.id));

Read the key from the environment

Every example here reads the credential from an environment variable. Do not paste a key into source you commit.