API Authentication

The Elyxir API uses Bearer token authentication. Include your API key in the Authorization header of every request.

Getting an API Key

1. Sign in to studio.elyxir.ai
2. Go to Settings > API Keys
3. Click Create API Key
4. Name your key (e.g., "Production", "Development")
5. Copy the key immediately - it's only shown once

API Key Format

Elyxir API keys follow this format:

elyxir_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

• Prefix: elyxir_ (7 characters)
• Total length: 47 characters
• Alphanumeric characters only

Using Your API Key

Include your API key in the Authorization header:

curl -X POST https://api.elyxir.ai/v1/chat/completions \
  -H "Authorization: Bearer elyxir_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-4o-mini",
    "messages": [{"role": "user", "content": "Hello"}]
  }'

Using with OpenAI SDK

Set the API key and base URL in the OpenAI client:

from openai import OpenAI
 
client = OpenAI(
    api_key="elyxir_your_api_key",
    base_url="https://api.elyxir.ai/v1"
)
 
response = client.chat.completions.create(
    model="gpt-4o-mini",
    messages=[{"role": "user", "content": "Hello!"}]
)

Environment Variables

Use environment variables to avoid hardcoding keys:

import os
from openai import OpenAI
 
client = OpenAI(
    api_key=os.environ.get("ELYXIR_API_KEY"),
    base_url="https://api.elyxir.ai/v1"
)

API Key Management

Viewing Keys

In Studio, go to Settings > API Keys to see:

• Key name
• Creation date
• Last used date
• Associated permissions

Revoking Keys

To revoke a compromised or unused key:

1. Go to Settings > API Keys
2. Find the key to revoke
3. Click Revoke
4. Confirm the action

Key Rotation

Best practice for key rotation:

1. Create a new key
2. Update your applications with the new key
3. Verify everything works
4. Revoke the old key

Security Best Practices

Do

• Store keys in environment variables
• Use different keys for development and production
• Rotate keys regularly (every 90 days)
• Monitor key usage in analytics
• Revoke unused keys

Don't

• Hardcode keys in source code
• Commit keys to version control
• Share keys between team members
• Use production keys for testing
• Expose keys in client-side code

Authentication Errors

Example error response:

{
  "error": {
    "message": "Invalid API key provided",
    "type": "authentication_error",
    "code": "invalid_api_key"
  }
}

Related

• API Overview - Getting started with the API
• Virtual Keys - Manage API access
• Error Handling - Handle API errors