Authentication

Every request carries an API key. It identifies your account and meters usage to it.

The header

Send your key as a bearer token:

Authorization: Bearer sk_live_your_key_here

Or, if a bearer header is awkward in your setup, use the alternative header:

x-api-key: sk_live_your_key_here

How keys work

• Created in your account. Generate keys at stevai.com/app/keys. You can hold as many as you like.
• Shown once. The full key is displayed a single time at creation. We store only a SHA‑256 hash — a stolen database yields no usable keys, and we can never show it to you again.
• Account‑scoped billing. Usage from a key is billed to the account that owns it. There is no shared or general billing account.
• Revocable. Revoke a key anytime from the same page — anything using it stops working immediately.
• Prefix + last 4. The console shows a key's prefix and last four characters so you can recognise it without seeing the secret.

Keep keys server‑side

An API key can act as your account. Never embed it in a browser app, a mobile app, or any client a user can inspect — it would be trivially extracted and abused. Call the API from your backend, store the key in an environment variable or secrets manager, and proxy requests from your own users through your server.

// on your server
const key = process.env.STEVAI_API_KEY;   // never hard-coded, never sent to the client

IP protection

Every key watches the source IP of its requests. The first IP a key is used from is trusted automatically; if the key is later used from an unrecognized IP, we alert you (a notification on your keys page) in case someone else has the key. If that unverified IP goes on to spend more than €100, the key is automatically blocked until you verify the IP — a stolen key can never quietly run up a large bill.

Running on cloud infrastructure where the IP rotates (autoscaling, serverless, a NAT pool)? Turn on Cloud modefor that key on the keys page. Cloud-mode keys still record their IPs for visibility but are never auto-blocked for a changing IP, so normal rotation won't interrupt you.

If a key leaks

Revoke it in the console and create a new one. Because keys are independent, rotating one never affects the others.