Authentication

The Authorization header

Every request to /v1 must send the developer key in the Authorization header as Bearer <key>. Keys start with hvd_.

curl https://api.hoveydai.ir/v1/models \  -H "Authorization: Bearer $HOVEYDAI_API_KEY"

If you use a client library, set its API key option; libraries of this kind build the same header from it, so you do not add anything yourself.

Authentication errors

If the key is missing, wrong or deleted, the response is 401 with a JSON error object whose type is authentication_error and whose code is invalid_api_key. The codes token_expired and session_revoked appear only when a dashboard login token is used instead of a key. The full shape and the fix for each code are on the Errors page.

Keeping the key safe

• Keep the key in an environment variable or a secrets manager, not in the code repository and not in browser code.
• Create a key per app. Each app's usage and cost show separately, and if a key leaks you delete only that one.
• Each request is recorded against its key, and the request limit is counted per key.