Authentication

Every request needs your AivoKey API key.

Sending the key

Use either header — both accept the same key:

Authorization: Bearer sk-aivo_...

x-api-key: sk-aivo_...

OpenAI-style clients send the first one, Anthropic-style clients the second. You never need to set them by hand when you use an SDK or a coding agent.

Managing keys

All of this happens in Console → API keys:

• Create — the full key is shown once. Copy it right away.
• Revoke — the key stops working immediately (requests get 401). This cannot be undone; create a new key if you need one.
• Expiry — a key can have an end date; after it, the key stops working.
• Balance fallback — for plan users: when the plan allowance runs out (or a model is not in the plan), a key with fallback keeps working on your prepaid balance. Without it, the request is refused.
• Rate limit — the console shows how many requests per minute a key may make.

Keep your key safe

• Treat it like a password: anyone with the key can spend your credit.
• Do not commit it to Git, paste it into a website, or put it in front-end code.
• Prefer environment variables over writing the key into config files.
• Use one key per machine or app, so you can revoke one without touching the rest.
• If a key leaks, revoke it and create a new one.