Authentication and API keys

Every request carries an Aderra key. Keys start with ak_ and are 46 characters long.

Sending the key

Header	Accepted on
Authorization: Bearer ak_...	Every endpoint
x-api-key: ak_...	/v1/messages, /v1/responses, /v1/models, /v1/audio/speech, /v1/audio/voices, /v1/audio/models, /v1/usage/prices

The OpenAI SDKs send Authorization: Bearer; the Anthropic SDKs send x-api-key. Both work where each SDK calls.

A missing, unknown or revoked key gets 401. See Errors for the body each endpoint returns.

Two kinds of key

There are two kinds, and they pay from different places.

	API key	Terminal key
Made on	Developers → Create key	Connect → Generate key
Pays from	Your API wallet (prepaid, separate from your plan)	Your plan’s credits
Plans	Every account, including Free	From Plus
Limits you can set	Monthly spending cap and requests per minute	None
Plan rules	None: the wallet, the cap and the rate limit are its only limits	Your plan’s rules, including its context window and media rules
Text to speech	Yes	No (refused with 403 api_key_required)
Meant for	Your own code, apps and products	Aderra Agent, Claude Code and Codex on your computer

Both kinds call the same endpoints. Use API keys for anything you build or sell. The rest of this section is about API keys.

Monthly spending cap

Each API key can have a monthly cap, set on the Developers page under the key’s … menu → Limits, in dollars.

• The cap counts what the key spent this calendar month (UTC): finished calls plus the holds of calls still running. It resets on the 1st.
• A call that would take the key past its cap is refused with 402 key_spend_cap_reached before anything is spent.
• The cap is checked before each call, so calls running at the same moment can together pass it by at most what they hold. Your wallet itself can never go below zero.
• No cap means the key can spend the whole wallet.

Give each product, environment or customer its own key and cap, and one leaked or runaway key cannot drain the account.

Rate limit

Each key allows 60 requests a minute unless you set another number, up to 600. See Rate limits and quotas for the account-wide limits.

Rotate a key

Keys do not expire. To replace one without downtime:

1. Create a new key on the Developers page and copy it.
2. Deploy it to your servers alongside the old one, then switch traffic over.
3. Check under Requests that the old key is no longer used.
4. Revoke the old key: … → Revoke → Revoke key.

Revoking is immediate and cannot be undone. An account can hold 20 active keys, terminal keys included; revoked keys do not count.

Note

Keys are managed in the app, on the Developers page. There is no API for creating or revoking keys.

Keep keys safe

• Store keys in environment variables or a secret manager, never in source code.
• Call the API from your server. A key in a browser or mobile app can be copied and spent by anyone.
• Aderra stores only a hash of each key. If you lose a key, create a new one.
• The Developers page shows each key’s first characters and when it was last used, so you can tell keys apart and spot one that should be idle.

Suspended accounts

If an account is suspended, every key on it is refused with 403 (account_suspended, or permission_error on /v1/messages). Contact us if you believe this is a mistake.