Authentication

Bearer token#

Promptix authenticates every API request with an API key sent in the Authorization header, using the Bearer scheme. There are no other headers to set; Content-Type: application/json is required for request bodies.

Authorization: Bearer sk_your_key_here

curl https://promptix.tn/api/v1/chat/completions \  -H "Authorization: Bearer $PROMPTIX_API_KEY" \  -H "Content-Type: application/json" \  -d '{"model": "openai/gpt-4o-mini", "messages": [{"role": "user", "content": "ping"}]}'

The OpenAI SDKs, the Vercel AI SDK and LangChain add this header for you from the api_key / apiKey option.

API keys#

Create and manage keys in Dashboard → API keys.

• A key looks like sk_ followed by 64 hexadecimal characters.
• The full key is shown once, when you create it. Promptix stores only a SHA-256 hash and the last four characters, so a lost key cannot be recovered: revoke it and create a new one.
• You can have up to 10 keys per account. Use one per project or environment (development, production).
• All keys of an account draw from the same credit balance. The dashboard shows, for each key, when it was last used, how many requests it made and how much it spent.

Store the key in an environment variable rather than in your code:

export PROMPTIX_API_KEY="sk_your_key_here"

Monthly spend limits#

Each key can have an optional monthly limit in TND. Before every request, Promptix adds up what the key has spent since the first day of the current month (UTC). When that total has reached the limit, the request is refused with HTTP 402 and nothing is billed:

{  "error": {    "message": "Monthly spend limit reached for this API key",    "type": "insufficient_quota",    "code": "key_monthly_limit"  }}

• The check happens before the request starts, so the request that crosses the limit still completes and is billed. The limit can therefore be exceeded by at most the cost of one request.
• The key works again on the first day of the next month, or as soon as you raise or remove its limit.
• Other keys of the same account are not affected.

Rotating and revoking keys#

To rotate a key, create a new one, deploy it, then revoke the old key from the dashboard. A revoked or deactivated key is rejected with 401. Revocation propagates within about a minute, because validated keys are cached briefly by the gateway.

Authentication errors#

If the Authorization header is missing or does not start with Bearer :

{  "error": "Missing or invalid API key"}

If the key is unknown, revoked, or belongs to a deactivated account:

{  "error": "Invalid API key or inactive user"}

The full list is in Errors and limits.

Keeping keys safe#

• Call Promptix from your server. Never put a key in a web page, a mobile app or a browser extension.
• Do not commit keys. Add .env to .gitignore and use your host's secret manager.
• Use separate keys per environment and per project, each with a monthly limit.
• If a key leaks, revoke it immediately in the dashboard.

A minimal server-side proxy, so the browser never sees the key:

// app/api/ask/route.ts (Next.js): the browser calls your route, never Promptix directlyimport OpenAI from 'openai'; const client = new OpenAI({  baseURL: 'https://promptix.tn/api/v1',  apiKey: process.env.PROMPTIX_API_KEY, // server-side environment variable}); export async function POST(req: Request) {  const { question } = await req.json();  const completion = await client.chat.completions.create({    model: 'openai/gpt-4o-mini',    messages: [{ role: 'user', content: String(question).slice(0, 4000) }],    max_tokens: 500,  });  return Response.json({ answer: completion.choices[0].message.content });}