Authentication

Every /v1 request needs an API key in the Authorization header:

Authorization: Bearer td-...

Create and manage keys

create a key for each app or environment, for example production and staging
set a spending limit per key, so one app cannot use the whole balance
disable or delete a key you no longer trust

All keys draw from the same prepaid account balance.

Call Orvado from your server. Never ship a key in a mobile app, browser code or a public repository.
Read the key from an environment variable or your secret manager.
If a key leaks, delete it in Tokens and create a new one. The old key stops working at once.

List the models your key can use:

curl https://orvado.dev/v1/models \
  -H "Authorization: Bearer $ORVADO_KEY"

A missing or wrong key returns 401:

{
  "error": {
    "message": "No token provided (request id: 2026102015161442847504045555018)",
    "type": "one_api_error"
  }
}

The message text differs for a missing key and an invalid one. Check the status code, not the text.