Docs
Authentication & keys
The ir- key, the Authorization header, rotation, and what each key bounds.
Every request authenticates with an API key in the Authorization header — the same shape OpenAI expects, so SDKs work unchanged.
http
Authorization: Bearer ir-...What a key decides
A key is not just a secret — it is the unit of control. Each key can be configured independently:
| Setting | Meaning |
|---|---|
| Billing source | Draw on the plan allowance, or pay from wallet credit. A credit key reaches every model. |
| Daily budget | A token or Rial ceiling, reset at Tehran midnight. |
| Model list | Restrict the key to specific models. |
| Expiry | A date after which the key stops working. |
Make one key per agent and per environment. If one leaks or runs away, you revoke only that one — and usage reporting tells you which spent what.
Rotation and revocation
- Rotating a key mints a new secret and the old one stops working immediately — there is no grace window.
- Revoking closes it permanently. Its usage history stays.
Where not to put a key
An ir- key can spend from your wallet. Never ship it in browser code, a mobile app, or a public repository — always call from your own server.