Authentication

Every request carries an API key in the Authorization header. The examples only reference the CHENVOYA_API_KEY environment variable and never show a key.

Send the API key

Write Bearer, a space and the API key in the Authorization header:

Authorization: Bearer ${CHENVOYA_API_KEY}

A missing or invalid key returns 401 authentication_failed, and the WWW-Authenticate response header names the Bearer scheme.

Create and keep keys

• Create API keys on the API keys page of the console; one API key works with every model.
• Keep and use API keys on servers only, in environment variables or a secret manager. Never put one in a web page, an app, a code repository, a document or a log.
• If you suspect a leak, suspend the key in the console, create a new one and replace the value on your servers.

Permissions and teams

API keys belong to a team, and tasks and assets are separated by team: a task created with any API key of your team can be read with any other key of the same team. Tasks and assets of other teams always return task_not_found or asset_not_found.

Registering and reading assets needs an API key with service.use permission; otherwise the answer is 403 permission_denied.

Authentication errors