Authentication

Every API request must include an API key in the Authorization header.

API key format

Keys follow the format sk-{32 hex characters}:

sk-4a9f2c1b8e3d7a05f6c2b9e1d4a8f3c7

Using your key

Include it as a Bearer token in every request:

curl https://backend.sovereigneg.com/v1/chat/completions \
  -H "Authorization: Bearer sk-4a9f2c1b8e3d7a05f6c2b9e1d4a8f3c7" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-oss-20b", "messages": [{"role": "user", "content": "Hello"}]}'

With the Python SDK:

from openai import OpenAI
 
client = OpenAI(
    api_key="sk-4a9f2c1b8e3d7a05f6c2b9e1d4a8f3c7",
    base_url="https://backend.sovereigneg.com/v1"
)

Managing keys

Action	How
Create	Dashboard → API Keys → Create new key
View	Dashboard shows each key's last 4 characters (`sk-…f3c7`), its rate limit, and its last use and spend in the current calendar month
Revoke	Dashboard → API Keys → Click Revoke (immediate, cannot be undone)
Rotate	Create a new key, update your code, then revoke the old one

The full key is shown only once at creation time. Copy it immediately. We store only the SHA-256 hash — we cannot recover your key.

Security best practices

Never commit keys to version control. Use environment variables.
Never expose keys in client-side code. Call the API from your server.
Rotate keys regularly. Create a new key, migrate, then revoke the old.
Use separate keys for dev and production. Easier to revoke if compromised.
Monitor usage. The dashboard shows per-key usage — investigate spikes immediately.

Error responses

An unknown sk- key returns 401:

{
  "error": {
    "type": "authentication_error",
    "message": "Invalid API key",
    "code": "invalid_api_key"
  }
}

Revoked key:

{
  "error": {
    "type": "authentication_error",
    "message": "API key has been revoked",
    "code": "key_revoked"
  }
}

A request with no Authorization: Bearer … header (the scheme is case-sensitive) gets 401 with code missing_auth_header, a token that doesn't start with sk- gets 401 with code invalid_token, and an expired key gets 401 with code key_expired. See Error Codes.

A key's expiry, its IP allow-list and a suspension of its organization apply to every endpoint the key can call: inference, /v1/models, /v1/usage and /v1/credits alike. A request from an IP address that isn't on the key's allow-list gets 403 with code ip_not_allowed, and every key of a suspended organization gets 403 with code org_suspended. The dashboard still shows your organization's usage and balance.

Keys made in the dashboard have the inference scope: they call the models and read your own organization's /v1/usage and /v1/credits. A key with only the usage:read scope reads /v1/usage but not /v1/credits, a key with only billing:read reads /v1/credits but not /v1/usage, and neither can call the models. Any key can list them with /v1/models. A request the key's scopes don't cover gets 403 with code key_scope_insufficient.