Authentication and keys

Every API call carries a key as a bearer token. Keys are made in the wallet and belong to your account, so anything they spend comes off your balance.

Authorization: Bearer askr_live_...

Making a key

1. Open the wallethttps://heyaskr.ai/wallet#api, signed in.
2. Name it, optionally cap itOne key per app or machine is a good habit. A daily cap, in credits, bounds what that key can spend in any rolling 24 hours.
3. Copy it nowThe key is shown once. Only a hash is kept, so it cannot be recovered later, only revoked and replaced.

Facts about keys

Format

askr_live_ followed by 32 URL-safe characters

Storage

SHA-256 hash only; the plain key exists nowhere after you copy it

Active keys

Up to 20 per account

Creation rate

10 per hour

Daily cap

Optional, in credits, checked before each request against the worst case that request could cost. Daily caps

Scopes

None. Every key can do everything the API does.

Expiry

None. A key works until you revoke it.

Revoking

Immediate. The next request with that key fails with 401. Its past usage stays in your activity.

When a key is wrong

{ "error": { "message": "Missing or invalid API key.", "type": "authentication_error", "param": null, "code": null } }

That is the answer for a missing header, a revoked key and a truncated paste alike. Make a new key rather than debugging an old one.

Keep it like a card number

• Environment variable or a secrets store, never a committed file and never front-end code.
• Set a daily cap on any key a script uses. A retry loop can spend a balance in minutes in a way nobody typing into a chat box ever will.
• One key per place. Revoking one then costs you one place, not all of them.

Test a key

curl https://heyaskr.ai/v1 -H "Authorization: Bearer $ASKR_KEY"

That prints your balance and the key in use. Connection check.