Authentication

All authenticated endpoints take a Bearer token in the Authorization header:

Authorization: Bearer sk_stav_live_...

Keys are sk_stav_live_... (production) or sk_stav_test_... (sandbox); user-scoped keys carry a sk_stav_user_ prefix. Legacy hm_* keys are no longer accepted. x-api-key is accepted as an alternative header, for Anthropic-SDK compatibility; Authorization wins when both are present.

A key may be restricted to a subset of scopes — inference:chat, inference:messages, inference:embeddings, inference:models. A key with no scopes set has full access; scopes are opt-in restriction. Note that the OpenAI SDK calls GET /v1/models, which needs inference:models.

GET /v1/auth/validate echoes back the workspace, key name, environment and scopes attached to a key — the cheapest way to check a deployment.

To create a key, go to Your workspace → Connect → API keys. Keep the secret value safe — it's shown once at creation and never again.