Authentication

The AIOZ AI API authenticates every request with an API key, sent in the x-api-key HTTP header. A key represents either a single user or an organization; whichever owns the key acts as the caller on every request.

How to send your key

Set the x-api-key header on every request. With the SDKs, you configure the key once at client construction.

curl https://api.aiozai.network/api/v1/api-key/balance \
  -H "x-api-key: $AIOZ_AI_API_KEY"

Personal and organization keys

Every API key is owned by either a user or an organization, and the calls you make with a key are authenticated as that owner.

Personal keys belong to your user account. Reach for one when you're working on a personal project or an individual integration; usage and inference cost will be attributed to your account.

Organization keys belong to an organization, and exist for shared and production work where cost and usage should roll up to the organization rather than to an individual.

See Managing API Keys for where each kind lives and how to create, rotate, and manage them.

Security best practices

Treat your API key like a password:

• Store it in an environment variable (AIOZ_AI_API_KEY), never inline in source code.
• Never commit a key to version control. If you do by accident, revoke it immediately and create a new one.
• Don't share keys across people or environments; create a separate key per use.
• If you suspect a key is compromised, revoke it and create a new one. See Managing API Keys.

The full key value is visible from the management UI any time you need to copy it, so you never have to store a backup elsewhere.