Concepts
Authentication
API keys, authentication headers, and access permissions
Every request needs an API key. Keys are created at Account → API keys. A key is 128 characters: sk-mel- followed by 121 random characters.
Sending the key
We accept both header shapes, so SDKs written against OpenAI or Anthropic work unmodified:
x-api-key: sk-mel-<YOUR_API_KEY>You can use either on any endpoint. Pick whichever your client prefers and be consistent.
Key handling
Keys are shown once. If you lose it, rotate it — there's no recovery button.
A few things to remember:
- Store in an env var —
MELIOUS_API_KEYor your convention. Never commit to version control. - Don't expose keys to browsers. Keep the key server-side and proxy inference calls through your backend. A leaked key costs you tokens, not just lint failures.
- Rotate on suspicion. The dashboard has a one-click revoke + reissue. Prior keys stop working immediately.
Scopes
Scopes limit which endpoints a key can call. Pick them when you create the key at Account → API keys; to change them later, create a new key (or use Replace on the existing one). A key created with no scopes has full access.
| Scope | Endpoints |
|---|---|
* | Everything |
inference.* | All inference endpoints below |
inference.chat | /v1/chat/completions, /v1/messages, /v1/messages/count_tokens, /v1/responses |
inference.embeddings | /v1/embeddings |
inference.rerank | /v1/rerank |
inference.images | /v1/images/generations |
inference.audio | /v1/audio/transcriptions, /v1/audio/speech |
inference.models | GET /v1/models |
inference.decisions | /v1/systemone |
kit.* | All kit endpoints below |
kit.tools | /v1/tools/* |
kit.mcp | /v1/mcp/* |
kit.documents | /v1/documents/convert |
kit.knowledge.read, kit.knowledge.write | /v1/vector_stores/* (read/search vs. create/attach/delete) |
/v1/batches and /v1/files accept any inference.* scope. A missing scope returns 403 auth_insufficient_scope.
A key may also be restricted to specific models; 403 model_not_allowed means you need an allowed model or a key with access. The check uses the Melious model ID that your request resolves to — on /v1/messages, a claude-* name is first mapped to a Melious model (see Models), and that model has to be on the key's list.
Plan benefits
Your plan determines whether API requests can use energy. Plans without API energy coverage pay in credits, as do batch requests on concurrency plans. See Pricing.
Related
Scope violations and other auth-level errors: Errors. How plan tiers map to throughput: Rate limits.