Get an API key
Create your first ModelSite API key in the console
Your API key is the single credential for calling the ModelSite API. Every request carries it in an Authorization: Bearer <key> header for authentication and billing; the x-api-key header is not accepted, and neither is a key in a URL parameter.
Create an API key
Go to the console's API Keys page and click Create New Key.
Name the key
Give the key a recognizable name (the console requires 3–64 characters, e.g. "production-server"), optionally pick an expiry, then click Create.
Copy it immediately
The full key is displayed when it is created — copy and store it right away. The list shows a masked value by default; for a newly created key you can later click Show or Copy to retrieve the full value. Older legacy keys cannot be retrieved and must be rotated to get a new value.
Key format
New keys start with sk-ms- followed by 64 hex characters; older keys starting with sk-relay- still work. A key in any other format is rejected with 401.
Use the API key
Put the key in an environment variable instead of hardcoding it:
export MODELSITE_API_KEY="sk-ms-xxxxxxxx"Never commit an API key to a repository or expose it in a frontend. A leaked key creates security risk and financial loss.
Manage API keys
From the API Keys page you can:
- Edit — change the name, or its expiry
- Rotate — generate a new secret value for the key while keeping its name and ID; the old value stops working (use this instead of delete+recreate when a key may have leaked but you don't want to update every caller's key ID)
- Revoke (delete) — click "Delete key": the key is permanently invalidated and disappears from the list. This is irreversible, and apps using it stop working
Lifetime
By default a key has no expiry and stays valid until you revoke it — but you can also set one (7 / 30 / 90 / 180 days, or a custom date) when creating or editing a key. Check the key's expiry in the console if requests start failing unexpectedly with 401.
Rotation, revocation, expiry and suspension take effect through the platform's configuration sync, normally within seconds rather than the same instant. If the sync is interrupted the gateway refuses service (503); see Error codes.
Limits
- A key cannot be scoped to specific models on its own. To restrict models, put the key in a team and set a model allowlist on the team (calling a model outside the allowlist returns
403 model_access_error). - Rate limits (RPM / TPM), balance and budget behavior are described in Platform extensions.
→ Next: Install an SDK, or go straight to Your first request.