uRouterGet started

Authentication

Use an inference key for /v1 and a control key for /control/v1.

Authorization

Send the key in the Authorization header. Model discovery does not require a key. Dashboard cookies are not API credentials.

Authorization
CredentialUse
ur_live_…Key inspection and request accounting; inference when enabled.
ur_res_…Granted reseller operations under /control/v1. Cannot run inference.
Authorization: Bearer $UROUTER_API_KEY

GET /v1/key

Returns metadata for the authenticated inference key, never its secret. Expired, revoked, missing or malformed keys return 401 invalid_api_key.

GET /v1/key
FieldMeaning
modelsAllowed public model IDs. An empty array imposes no model restriction.
operationsAllowed operation names. An empty array imposes no operation restriction. This does not enable unreleased endpoints.
expires_atISO 8601 expiry, or null for no expiry.
mask_secretsSaved text-masking policy, not proof that masking ran.
name, prefixDisplay metadata; neither can authenticate a request.
{
  "name": "Production",
  "prefix": "ur_live_\u2026",
  "mask_secrets": false,
  "models": [],
  "operations": [],
  "expires_at": null
}

Scope and rotation

Use one key per app. A replacement secret retains the logical key’s request history and limits; the previous secret stops authenticating. A different key cannot read those requests just because it belongs to the same account.