Authentication

API keys

Every request must include a key in the Authorization header:

Authorization: Bearer moe_sk_live_your_key_here

Keys have three properties worth knowing:

• Format: they always start with moe_sk_live_.
• One-time display: the full key is shown exactly once at creation. We only store a hash, so it cannot be recovered.
• Per-account: keys belong to your account and draw from your credit balance. You can create up to 10 active keys and revoke any of them at any time.

Creating and managing keys

Keys are managed in the research workspace: account menu → API keys. From there you can create, copy-once, and revoke keys.

A revoked key stops working immediately. Any in-flight report started with that key keeps running and its result stays accessible.

Authentication errors

{
  "message": "Missing API key. Pass it in the Authorization header: `Authorization: Bearer moe_sk_live_...`."
}

• 401 — the key is missing, malformed, revoked, or invalid.
• Keys are not tied to a specific IP or origin. Keep them secret and rotate them regularly.

Security notes

• Never hardcode keys in client-side code or public repositories.
• Store keys in environment variables or a secrets manager.
• Use one key per environment (development, staging, production) so a leak can be isolated.