Authentication

Project API keys for inference, Admin API keys for policies and administration.

Antara has two kinds of API keys. Both are shown in full only once, when you create them.

Key	Format	Use it for	Create it in
Project API key	ak_ + 43 characters	Inference: /v1/chat/completions, /v1/responses, /v1/messages, /v1/messages/count_tokens, /v1/models, /v1/credits	The project’s API keys page
Admin API key	ak_admin_ + 43 characters	The Policy and Admin APIs under /v1/organization/…	The organization’s Admin keys page

​

Sending a key

Bearer (all endpoints)

curl https://api.antarah.dev/v1/models -H "Authorization: Bearer $ANTARA_API_KEY"

Inference endpoints accept Authorization: Bearer or x-api-key, so both SDKs work unchanged. If you send both, Authorization wins.

A key of the wrong kind fails with a message naming the right one: 401 invalid_api_key on inference, 401 invalid_admin_credential on management endpoints.

​

Project API keys

A project key belongs to one project. Its usage counts toward that project’s spend limit and rate limits. By default it has all three inference permissions:

Permission	Grants
inference	Chat Completions, Responses, Messages, count tokens
models:read	GET /v1/models
credits:read	GET /v1/credits

Archiving a project revokes all of its keys. Requests with a revoked or expired key get 401 invalid_api_key.

​

Admin API keys

An Admin API key acts for the whole organization, with any subset of these permissions. You can only grant permissions you have yourself.

Permission	Grants
organization:read	Read the organization
projects:read	List and read projects
projects:create	Create, rename, and archive projects
project_api_keys:read	List and read project keys
project_api_keys:create	Create project keys
project_api_keys:revoke	Revoke project keys
admin_api_keys:read	List and read Admin API keys
admin_api_keys:create	Create Admin API keys
admin_api_keys:revoke	Revoke Admin API keys
billing:read	Balance, usage, and costs
spend_limits:read	Read spend limits
spend_limits:write	Set and remove spend limits
policies:read	List and read policies
policies:write	Create, edit, publish, pause, resume, and delete policies

A missing permission gets 403 permission_denied.

​

Keeping keys safe

• Keep keys on your server. Anyone with a key can spend your credits.
• Use one key per app or environment, so you can revoke one without touching the others.
• Revoke a leaked key at once in the console, then create a new one.