API reference
Authentication
Every request carries your API key as a bearer token.
Authorization: Bearer lyber_prepaid_…Keys are lyber_prepaid_ followed by 64 hexadecimal characters. Create, name, limit and rotate them under API keys. A key spends its account's prepaid credit; a website sign-in never stands in for a key.
Errors
| Status | Code | Meaning |
|---|---|---|
401 | authentication_error | The key is missing, malformed, revoked or unknown. |
401 | api_key_expired | The key has expired. Create a new one. |
403 | access_approval_required | The account isn't approved yet. Request access. |
403 | model_not_allowed | This key isn't allowed to use the model. |
Keep keys secret
- Read keys from the environment or a secret manager. Never commit them, log them or ship them in browser or mobile code.
- Use one key per app or agent, each with its own monthly limit, so one leak or runaway loop is contained.
- If a key leaks, revoke it in the dashboard. A key can read its limits but never raise them.