Authentication

Every request is authenticated with an API key that belongs to your organization. Keys carry their own limits, so one key can be scoped to one app, one model set, one budget.

Create a key#

Open Inference → API keys and create one. Keys look like ahu_live_ followed by 32 characters. The full key is shown exactly once; afterwards the dashboard shows only its prefix and last four characters. We store a SHA-256 hash, never the key itself, so a lost key cannot be recovered, only replaced.

Send it#

Put the key in the Authorization header as a bearer token. The x-api-key header is accepted too, which is what the Anthropic SDKs send.

headers

Authorization: Bearer ahu_live_…
# or, equivalently
x-api-key: ahu_live_…

What a key can be restricted to#

Each setting is per key and can be changed at any time from the dashboard. Changes reach the edge within a minute.

Setting	Effect	When it bites
Allowed models	The key may call only the listed model ids.	`403 model_not_allowed`
IP allowlist	CIDR ranges the key may be used from.	`401` from any other address
Expiry	A date after which the key stops working.	`401` API key expired
Rate limit	Requests per minute for this key. Default 600.	`429 rate_limit_exceeded`
Monthly hard cap	Spend in the calendar month at which requests stop.	`402 hard_cap_reached`
Monthly budget	A soft figure shown against spend in the dashboard. Never blocks.	Alerts only
Zero data retention	Prompts and completions are never stored; the cache is skipped.	Privacy

The organization can also carry a hard cap; the tighter of the two applies. See Rate limits & spend caps.

Revoke a key#

Revoking a key in the dashboard takes effect at the edge within 60 seconds. Requests with a revoked key get 401 invalid_api_key, the same response as an unknown key, so a revoked key confirms nothing to whoever holds it.

Inspect a key#

GET/v1/key

Returns the calling key’s scope and this month’s spend for its organization. Useful for a health check at startup, or to show a customer their remaining budget.

request

curl https://api.ahurasense.com/v1/key \
  -H "Authorization: Bearer $AHURA_API_KEY"

response

{
  "key_id": "e435ceab-…",
  "org_id": "70cecc89-…",
  "zdr_enabled": false,
  "allowed_models": null,
  "billing": "platform",
  "usage": {
    "month": "2026-09",
    "spent_cents": 412,
    "monthly_budget_cents": 5000,
    "hard_cap_cents": 10000
  }
}

allowed_models is null when the key may call every model.
billing is how the request is charged: platform, against your AhuraSense balance.
spent_cents is the organization’s month-to-date spend, across all its keys.

Request headers#

All optional. Each is explained on the page it belongs to.

Header	Values	Purpose
`X-Ahura-Request-Id`	any string	Your own correlation id. Echoed back; we generate one when absent.
`X-Ahura-Preset`	preset name	Use a named default model. Presets.
`X-Ahura-Guardrail`	`off` \| `warn` \| `block`	Prompt-injection policy for this request. Guardrails.
`X-Ahura-Cache`	`off` \| `aggressive`	Skip or widen the response cache. Caching.
`X-Ahura-Cache-TTL`	60 to 3600	Seconds a cached answer stays valid.
`Cache-Control`	`no-cache`	Standard way to skip the cache.

Response headers#

Header	Meaning
`X-Ahura-Request-Id`	The request id. Quote it in support requests.
`X-Ahura-Model`	The catalog id that served the request and that usage is recorded under.
`X-Ahura-Billing`	How the request was charged: `platform`.
`X-Ahura-Routing`	`managed` when the model runs on AhuraSense GPU infrastructure rather than a partner backend. Absent otherwise.
`X-Ahura-Cache`	`hit`, `miss`, `bypass`, `streaming-skipped` or `non-deterministic`.
`X-Ahura-Cache-Age`	Seconds since a cached answer was produced. Only on hits.
`X-Ahura-Guardrail`	`clean`, `flagged` or `blocked`.
`X-Ahura-Preset`	The preset that was applied, when one was.
`X-Ahura-RateLimit-Remaining`	Requests left in the current bucket.
`Retry-After`	Seconds to wait. Sent with `429` and with `503`.

Something missing or wrong on this page? Tell us, and quote the page title.