Authentication

Put the key in the Authorization header as a bearer token. OpenAI SDKs do this for you when you pass api_key.

Authorization: Bearer $WORG_API_KEY

Clients that send an x-api-key header instead also work.

• A key starts with sk-worg- and is shown once, when it is created. Worg keeps only a SHA-256 hash of it, so a lost key cannot be shown again: create a new one and revoke the old one.
• Keys are created in the console, once the organization has a prepaid balance.
• A key expires after 90 days unless you pick another expiry: 1, 7, 14, 30 or 60 days, a date, or no expiry. A key without expiry stays valid until someone revokes it, so keep its budget low.
• A key can be limited to some models and combos. A request for any other model gets 403 model_not_allowed.
• A revoked key gets 403 key_disabled, an expired one 403 key_expired.

Every key has a requests-per-minute limit, a tokens-per-minute limit, a cap on requests running at once, and a monthly budget. There is no key without limits. A new key gets 60 RPM, 200,000 TPM, 32 concurrent requests and US$50 per month. A workspace admin can set other limits when creating the key, within the budgets of the key's workspace and organization. The codes for each limit are in Rate limits.

When a key spends at least US$5 in one hour and more than 10 times its hourly average of the previous 7 days, Worg suspends it and emails the organization's contact. Requests with it get 403 key_suspended.

An owner or admin then picks one of two actions in API keys:

• Rotate: a new key with the same name, limits and expiry replaces it, and the old key is revoked.
• Resume: for a false alarm, confirmed with a two-step verification code.

A key that spikes again within 24 hours of a resume can only be rotated.

Call the API from your backend, never from a web page. Browsers on other sites cannot call /v1, and a key in front-end code can be read by anyone who opens the page.