Authentication

Every request to APIHub Star is authenticated with a bearer API key. Keys are scoped, environment-aware and fully auditable.

API keys

Pass your key in the Authorization header:

Authorization: Bearer ah_live_•••••••

Keys are prefixed by environment — ah_live_ for production and ah_test_ for sandbox — so they can never be confused.

Scopes

Grant the least privilege a key needs. Scopes are checked on every call.

• chat:write — create completions and chat requests
• embeddings:write — generate embeddings
• analytics:read — read usage and cost metrics
• admin — manage keys, members and policies

Rotation & security

• Rotate keys with zero downtime — old and new keys overlap for a grace window.
• Set per-key IP allow-lists and rate limits.
• All key usage is written to an immutable audit log.