Authentication

The header

Send your key as a bearer token:

Authorization: Bearer mb_live_EXAMPLE_NOT_A_REAL_KEY_00000000000000000000

The official OpenAI SDKs do this for you when you set the API key.

Keys

• Prefix mb_live_. That is the only key class that exists today; there is no separate admin or management key.
• Tenant-scoped. A key resolves to exactly one tenant. The tenant is never taken from anything the client sends. It is derived from the key itself, server-side.
• Shown once. Create keys in the console and store them in a secret manager. We cannot recover a key after creation, only revoke and reissue.
• Revocable immediately. Revocation takes effect on the next request.

Rotation

1. Create the new key in the console.
2. Deploy it.
3. Confirm traffic is flowing on the new key.
4. Revoke the old one.

Because a key maps to a tenant rather than to a person, rotating does not change what the key can reach. If a key may have leaked, revoke first and reissue after. A revoked key cannot spend your balance.

When authentication fails

A missing, malformed, invalid, or revoked key returns 401 with the flat gateway envelope:

{ "error": "modelbeat: invalid or revoked api key" }

Note that error is a string here, not an object. That is how you tell a ModelBeat-level refusal from a provider error. See Errors.

If the control plane cannot be reached to verify your key, ModelBeat returns 503 rather than letting the request through:

{ "error": "modelbeat: auth unavailable" }

This is fail-closed by design: an unverifiable request is refused, never served unauthenticated. Retry with backoff.

What we log

We never log your API key, and we never log prompt or response bodies. Request metadata (tenant, key id, served model, token counts, cost, latency) is recorded for billing and for your usage reporting.