Docs
Authentication
Every request to the Aniron API is authenticated with a bearer token in the Authorization header. There is no separate signing scheme or session cookie.
Bearer tokens
Pass your API key as a bearer token on every request:
curl https://api.aniron.ai/v1/chat/completions \
-H "Authorization: Bearer sk-aniron-xxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-d '{ "model": "aniron/llama-3.1-70b", "messages": [...] }'
Keys are prefixed sk-aniron- so they're
easy to identify in logs and secret scanners. If the header is missing, malformed, or the
key is invalid or revoked, the API returns 401:
{
"error": {
"message": "Incorrect API key provided.",
"type": "invalid_request_error",
"code": "invalid_api_key"
}
} Key management
Create, name, and revoke keys from the dashboard at
app.aniron.ai.
Each key can carry its own per-key budget and rate limit, so a good pattern is one key
per environment or service (prod-api,
staging-worker, and so on) rather than
sharing a single key everywhere.
Rotating keys
Rotate a key by creating a new one, deploying it alongside the old one, and revoking the
old key once traffic has fully shifted. Both keys are valid simultaneously during the
overlap window, so rotation doesn't require downtime. Revoked keys fail immediately with
401 invalid_api_key — there is no grace
period, so confirm the new key is live in production before revoking the old one.
Storing keys
Treat API keys as secrets: load them from environment variables or a secret manager, never commit them to a repository, and never expose them in client-side code — a key embedded in a browser bundle or mobile app is public. Proxy browser and mobile requests through your own backend instead.
Create your first key
API keys are managed from the dashboard, no configuration file required.