Authentication

Every API request is authenticated with an API key, sent as a bearer token in the Authorization header.

Create a key

1. Open API keys in the console and choose Create key.
2. Name it after where it runs, for example production or support-bot.
3. Copy the key. It starts with lh_ and is shown only once.

We store only a hash of each key, so we cannot show it again. If you lose a key, create a new one and revoke the old one. You can have up to 25 active keys per account.

Send the key

Pass the key in the Authorization header on every request:

Authorization: Bearer lh_...

For example, to list the available models:

curl https://layahost.com/v1/models \
  -H "Authorization: Bearer $LAYAHOST_API_KEY"

The official Jev SDKs read the key from the TYPESAFE_API_KEY environment variable. Put your layahost key there and point the SDK at layahost, as described in Migrate from Jev.

Keep keys secret

• Call the API from your server, never from a browser or a mobile app, where anyone can read the key. The JavaScript SDK refuses to run in a browser unless you set dangerouslyAllowBrowser.
• Load keys from environment variables or a secrets manager, not from source code.
• Use one key per environment or service. Usage is tracked per key, and you can revoke one without touching the others.

Revoke a key

Revoke a key on the API keys page. It stops working immediately: requests that use it get a 401. Revoking cannot be undone.

Authentication errors

A request without a valid key gets 401 Unauthorized with error_type set to authentication_error. These requests are not billed and do not count towards your rate limit.

No Authorization header:

{
  "detail": {
    "error_type": "authentication_error",
    "message": "Missing API key. Send it as \"Authorization: Bearer <API_KEY>\"."
  }
}

A key that does not exist or has been revoked:

{
  "detail": {
    "error_type": "authentication_error",
    "message": "Invalid or revoked API key."
  }
}

See Errors for every error type.