GET /v1/status and GET /v1/billing/plans are public. Everything
else under /v1 requires the header. Keep the key in the environment.
Test your key
GET /v1/models returns 200 for a working key and 401 otherwise.
Scopes
A key is either unrestricted, with access to the whole API, or limited to named scopes. Generating media needs both scopes below, since creating a run and reading its result are separate permissions.
A valid key without the required scope returns
403 with
error.code: "api_key.scope_required". A missing, malformed, or revoked
key returns 401.
Browsers and embeds
Keep API keys server-side. Anything shipped to a browser is readable. Embeds let a visitor reach an avatar directly, using a public embed ID (emb_...) that carries no account access.