Authentication
Two credentials are accepted.
| Credential | How it is sent | Use it for |
|---|---|---|
| API key | Authorization: Bearer inf_... | Applications. Created under Gateway › API keys. |
| Session | The sign-in cookie, sent automatically by the browser | The portal and the Playground. |
An API key authenticates every serving endpoint. It cannot create, change, or revoke keys; those need a session, so a leaked key cannot mint its own replacement or revoke yours.
Three endpoints need no credential: GET /models, GET /models/{model_id}/health, and the routing preview.
A request with a missing or invalid key gets a 401. A request with a valid key that is revoked, whose account is deactivated or unverified, or that asks for something its routing policy does not allow gets a 403 naming what was refused.
Idempotency
Send an Idempotency-Key header on any request that spends money. A retry with the same key replays the original response instead of running the request again.
This matters because client timeouts are long and retries are shallow: the ordinary failure is that your socket gives up while the model is still working, you retry, and the model runs twice.
Example
curl https://api.inferbase.ai/api/v1/inference/chat/completions \
-H "Authorization: Bearer inf_your_api_key" \
-H "Idempotency-Key: 8f14e45f-ea6b-4f2b-9d61-2c0b1a7d3e55" \
-H "Content-Type: application/json" \
-d '{"model": "auto", "messages": [{"role": "user", "content": "Hello"}]}'Behavior
| Situation | Result |
|---|---|
| Same key, same body, first request completed | The original status, body, and headers are returned, with Idempotent-Replay: true. No model is called, no credit reserved, no usage row written. |
| Same key while the first request is still running | 409. There is nothing to replay yet. Retry once the first completes. |
| Same key, different body | 422. Returning someone else's answer would be worse than refusing. |
| The first request failed | Nothing is stored and the key is released at once. A failed request made no charge, so a retry runs normally. |
| Streaming request | Guarded but not replayed. A duplicate in flight gets the 409; once the stream ends the key is released and a later retry runs again. |
A key is remembered for 24 hours and is scoped to the organization, so two API keys of one organization retrying the same logical request are the same request.
Last updated September 10, 2026.