Authentication

API Key Authentication

All API requests require authentication using an API key passed in the x-api-key header.

Header Format

x-api-key: <your-api-key>

Example Request

curl -H "x-api-key: <your-api-key>" \
     <your-api-url>/conversation

Obtaining an API Key

To obtain your API key:

1. Contact the AI Commons team
2. Receive your unique API key and endpoint URL
3. Store your API key securely (never commit to version control)
4. Use environment variables or secure key management systems

Security Best Practices

• Never commit API keys to version control - Use environment variables or secret management systems
• Rotate keys regularly - Update API keys periodically for enhanced security
• Use HTTPS only - All API requests must use HTTPS to encrypt data in transit
• Monitor usage - Track API calls to detect unauthorized access
• Limit key scope - Use different keys for different environments (dev, staging, production)

Authentication Errors

401 Unauthorized

{
  "detail": "Invalid API key"
}

Cause: Missing or incorrect x-api-key header

Solution: Verify your API key is correct and properly included in the request header

Environment Variables

Store your API credentials as environment variables:

Bash/Zsh

export API_KEY="your-api-key-here"
export API_URL="your-api-url-here"

Python

import os

API_KEY = os.getenv('API_KEY')
API_URL = os.getenv('API_URL')

headers = {
    'x-api-key': API_KEY,
    'Content-Type': 'application/json'
}

JavaScript/Node.js

const API_KEY = process.env.API_KEY;
const API_URL = process.env.API_URL;

const headers = {
    'x-api-key': API_KEY,
    'Content-Type': 'application/json'
};