Authentication

Authorization: Bearer sk-tokenhub-…

Key rules

• Keys are shown once at creation. We store only a hash, so a lost key is replaced, never recovered.
• Each key belongs to a workspace and carries an optional monthly spend cap. Model access can restrict a key to an explicit allowed_models list. A refused model returns 403 model_not_allowed.
• Rotating a key gives it a new secret, shown once. The previous secret keeps working for 24 hours, then returns 401; if it leaked, choose to end it at once instead. The key's name, cap and spend history stay the same.
• Revoking a key takes effect immediately; the key's usage history remains in your Activity log.

Unauthenticated responses

HTTP/1.1 401 Unauthorized
{
  "error": {
    "code": 401,
    "type": "authentication",
    "message": "invalid API key"
  }
}

The response also carries WWW-Authenticate: Bearer. The message says whether the token was missing, unknown or revoked; branch on type, not on it.