Authentication

API keys, scopes, and management via the dashboard.

API keys

Every request to an AI category authenticates with an API key in the Authorization header:

http

Authorization: Bearer emk_live_xxxxxxxxxxxxxxxxxxxx

A key is always attached to an environment (e.g. "development", "production"), itself attached to a project then to an organization. The prefix distinguishes the key type:

emk_live_... — production key, calls that are actually billed
emk_test_... — test key, automatically created for any environment other than "production"

The raw value of a key is only shown once, at the time of creation (POST /v1/environments/{environment_id}/api-keys). Only its hash is kept server-side — if you lose it, revoke it and create a new one.

Scopes

At creation, a key can be restricted to a list of categories (scopes: chat, images, vision, audio, video, embeddings, translation, agents). A key with no explicit scope (scopes: [], the default) has access to all categories — restricting access is therefore always an explicit choice.

bash

curl -X POST https://api.ileai.io/v1/environments/{environment_id}/api-keys \
  -H "Authorization: Bearer <jeton de session>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Cle chat uniquement",
    "scopes": ["chat"]
  }'

A request to a category not authorized by the key's scopes returns 403 insufficient_scope.

Managing keys

From the dashboard (API Keys) or via the API:

bash

# Lister les cles d'un environnement
GET /v1/environments/{environment_id}/api-keys

# Revoquer une cle
DELETE /v1/api-keys/{api_key_id}

Accounts and teams

API key authentication is for programmatic calls (SDK, direct HTTP). The dashboard itself uses an account session (email/password, httpOnly cookies) — the /v1/account, /v1/auth/login, /v1/orgs/{id}/invitations endpoints etc. do not accept an API key and are not intended for programmatic use.