Authorization: Bearer header. Nothing else authenticates the inference API.
Get a key
1
Open the model page, or Settings
The fastest path is the Access panel on any model’s page in the Model Library, which hands you a key next to snippets that already use it. The full list lives in Settings, API keys.
2
Copy the secret immediately
It is displayed once, at creation. After you close the dialog only a one-way digest remains, and we cannot recover the plaintext for you.
3
Set a rate limit and an expiration, or accept the defaults
With no custom rate limit the key follows your workspace’s current allocation, including later upgrades. A custom per-key value stays in place, clamped to the workspace maximum.Expiration is off unless you turn it on, and a key created without it never expires. When you do turn it on the form starts at 90 days, and you can choose 30, 60, 90 days or 1 year.
Send it
Key format
Every key isrp_ followed by 40 lowercase letters or digits.
A
runinfra login CLI key shares the rp_ prefix and the 40 character body, and it cannot call the inference API. If a key that looks right returns 401, check that it is a workspace API key and not a CLI login key.Two key scopes
A workspace-scoped key is the one to use. Set the base URL once, then let themodel field choose the target. It suits dashboards with several models, backend services that route at runtime, and one team key covering the whole workspace.
A pipeline-scoped key is bound to one pipeline, the saved setup one optimization session produced, and carries that pipeline id in the URL path. It exists for integrations built before the workspace flow, and for clients that must only ever touch one pipeline. Sent to the flat /v1 base URL it is refused with 400 auth_error, and the message names the URL to use instead.
Rotate, revoke, expire
Rotation needs no downtime because the old and the new key are both valid until you revoke: click Rotate on the key row, deploy the new secret, let traffic drain, then click Revoke on the old one. A revoked key is refused with403 and the message API key is deactivated. An unknown or deleted key returns 401 with Invalid API key. Branch on error.type and error.code, never on the message text.
Expiration is enforced at the request itself rather than by a cleanup job, so there is no window in which an expired key still works. An expired key returns 401.
Environment variables
OPENAI_API_KEY on their own, so for a zero-config drop-in map OPENAI_API_KEY=$RUNINFRA_GATEWAY_KEY and OPENAI_BASE_URL=$RUNINFRA_BASE_URL. Use a separate key per environment so one leak has a bounded blast radius.
RUNINFRA_GATEWAY_KEY is the name for the gateway key shown in the dashboard. Older snippets used RUNINFRA_API_KEY, which the self-hosted export kit reserves for its own secret. Existing environments keep working; name new ones RUNINFRA_GATEWAY_KEY so the two never collide.Security posture
Hashed at rest
Versioned HMAC-SHA-256 on insert. Plaintext is never written to disk.
Constant-time compare
Lookup is by indexed hash, not string comparison, so timing cannot enumerate keys.
Audit log
Key lifecycle changes and attributable authentication failures are logged for SOC2 CC6.6.
Per-key rate limit
A sliding 60 second window per key, independent of network-layer protection. It fails closed if it cannot be reached.
Related
Model APIs quickstart
Make your first call with the key you just created.
Chat completions
The full request contract.
Rate limits
What the per-key limit you set actually governs.