Authentication
Use manually approved Bearer API keys safely.
Send the Key in one header:
Authorization: Bearer sd_live_...Phase one supports live Keys only. Keys are manually issued, expire by default, can be revoked immediately, and store only an HMAC digest in the API control KV. They are separate from the legacy PC API Key page and do not require a new database table.
Available scopes are models:read, credits:read, generations:read, and generations:write. A Key may also restrict model IDs, requests per minute/day, concurrent generations, and real-person access.
Never place a Key in a query string, request body, prompt, browser, mobile binary, log, error tracker, Git repository, or exported n8n workflow. Store it in a server secret manager or n8n Credential. Contact support to rotate or revoke a Private Beta Key.