Integrations
Account API
Keep the application key separate from the web session that owns the account, wallet, and key-management actions.
Authentication boundary
Public inference uses a Bearer key on /v1/chat/completions. Account routes require a signed-in web session and appropriate origin/CSRF checks for mutations. A Bearer key cannot create other keys, fund a wallet, or change account settings.
Account surface
| Route | Session action |
|---|---|
| GET /api/account/me | Account overview, wallet, keys and activity summaries. |
| POST /api/account/keys | Create an application key. |
| POST /api/account/keys/{id}/rotate | Replace a secret. |
| POST /api/account/keys/{id}/revoke | Disable a key. |
| DELETE /api/account/keys/{id} | Disable and hide a key's dashboard record. |
Use the dashboard for these workflows. Mutation requests must meet the platform's session and origin protections.
Account security
Keep account MFA enabled and use separate keys with conservative limits. Administrator actions require additional role checks and current MFA confirmation.