API preview: generation providers are not connected. An authenticated request can return 503 without creating a task or charging credits.
Use a Bearer key
External applications authenticate with an API key in the Authorization header. Browser access to your developer console uses a login session instead. A login cookie is not a replacement for your application key.Account and key boundaries
Every operation belongs to an account. A key can only access that account’s resources and the actions allowed by its scopes. Guessing another task ID never grants access. Current scopes include generations:write and usage:read. Revoking a key blocks subsequent authenticated calls. Before paid provider execution opens, key budgets must also include settled spending and outstanding reservations; a configured budget field alone is not enforcement.Rotate without losing history
- Create a replacement key, update your server, verify access, then revoke the old key.
- Revocation does not cancel in-flight tasks or refund completed work. Use the console or another authorized key to follow existing tasks.
- Never include a full key when sharing logs or asking for help. Share the request ID instead.