aisplice

Getting started

Keys & security

#Bearer authentication

Every request authenticates with a single HTTP header. There is no extra user-id header and no session cookie — the bearer key alone identifies your account and routes the call. Signatures are needed only on keys that turn on request signing.

auth.sh
curl https://www.aisplice.store/v1/chat/completions \
  -H "Authorization: Bearer sk-YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-5.6-luna","messages":[{"role":"user","content":"hi"}]}'

#Managing keys

Create and rotate keys in Console → API Keys. A key is shown in full only once, when you create it.

Each key can carry its own RPM / RPD caps, quota ceiling, model whitelist, IP allowlist, and expiry — scope one key per project so a leak or a runaway script never takes the whole account down.

Open Keys

#Key security

Never ship a key in a browser bundle

A browser-visible key can be extracted by anyone who opens devtools. Proxy through your own backend and inject the key server-side, or use short-lived scoped keys.
  • Load keys from environment variables or a secret manager — never commit them to git.
  • Rotate immediately if a key appears in a log, a screenshot, or a pasted stack trace.
  • Set a quota ceiling on keys used by experiments so a loop cannot drain the wallet.
  • Use the IP allowlist for server-side keys with a fixed egress address.

Still stuck?

Send us the request ID or the error message and we will look into it.

PreviousUse it in an appNextChat