Authentication

The Authorization header

Every request to /v1 must send the developer key in the Authorization header. Keys start with hvd_.

curl https://<HOVEYDAI_BASE_URL>/v1/models \  -H "Authorization: Bearer $HOVEYDAI_API_KEY"

The official OpenAI library builds this header from api_key; you do not add anything yourself.

Authentication errors

If the key is missing, wrong or expired, the response is 401 in the OpenAI error shape and error.code is one of invalid_api_key, token_expired or session_revoked. The full shape is on the Errors page.

Keeping the key safe

• Keep the key in an environment variable or a secrets manager, not in the code repository and not in browser code.
• Create a key per app. Each app's usage and cost show separately, and if a key leaks you delete only that one.
• Each request is recorded against its key, and the request limit is counted per key.