Authentication

The Vaelor API authenticates every request with an API key sent as a Bearer token. Keys belong to your account: requests made with a key spend that account's credits and can read and delete that account's images, tracks, files and cases.

Creating keys#

Create and manage keys on the API keys page in the dashboard. You can have up to 10 keys per account. Give each key a name that says where it runs, such as prod-worker or local-dev, so you know which one to delete if it leaks.

Keys look like this:

vk_live_7Qm2c9XkTn4bRz8LwPyH3eVa6JsD1fGu

Sending the key#

Pass the key in the Authorization header on every request.

curl https://api.vaelor.chat/v1/usage \
  -H "Authorization: Bearer $VAELOR_API_KEY"

await fetch('https://api.vaelor.chat/v1/usage', {
  headers: { Authorization: `Bearer ${process.env.VAELOR_API_KEY}` }
})

requests.get(
    "https://api.vaelor.chat/v1/usage",
    headers={"Authorization": f"Bearer {os.environ['VAELOR_API_KEY']}"},
)

A missing, malformed or deleted key returns 401 Unauthorized:

{
  "error": "Unauthorized"
}

Keeping keys safe#

• Load keys from environment variables or a secrets manager.
• Use one key per environment and per service, so you can delete one without breaking the others.
• If a key is exposed, delete it on the API keys page. Deletion takes effect immediately and can't be undone; create a new key and redeploy.
• The Last used column shows when a key last authenticated a request. Delete keys you no longer use.

Account restrictions#

Keys inherit your account's plan and settings. Uncensored requests require that the account owner is 18 or older and has accepted the Terms. Admin accounts can't create keys for customer endpoints.