Docs / Getting started
Authentication & keys
One account can hold multiple API keys, each with its own credit limit and model allowlist per use case.
The auth header is identical to OpenAI's. A missing Bearer prefix is the most common cause of a 401.
HTTP
Authorization: Bearer sk-compass-xxxxxxxxxxxxxxxx
Content-Type: application/jsonEach key has three properties
- Credit limit: the key is disabled automatically once the limit is spent, without affecting other keys on the account.
- Allowed models: restrict a key to a model family, e.g. DeepSeek models only.
- On/off switch: disable at any time; in-flight streaming requests are cut off immediately.
If a key leaks
Flip the switch in the key list to revoke it instantly, then create a replacement. Spend already incurred can be audited in the usage logs, filtered by key.
Never embed API keys in frontend code or client apps. If you need browser-side calls, proxy them through your own server.