# Authentication

Source: https://docs.getworg.com/authentication

Every request to /v1 carries an API key. A request without a valid key gets 401 before anything else runs.

## Send the key

Put the key in the Authorization header as a bearer token. OpenAI SDKs do this for you when you pass `api_key`.

Header:

```
Authorization: Bearer $WORG_API_KEY
```

Clients that send an `x-api-key` header instead also work.

## Keys

- A key starts with a fixed prefix and is shown once, when it is created. Worg keeps only a SHA-256 hash of it, so a lost key cannot be shown again: create a new one and revoke the old one.
- Keys are created in the console, once the organization has a prepaid balance.
- A key expires after 90 days unless you pick another expiry: 1, 7, 14, 30 or 60 days, a date, or no expiry. A key without expiry stays valid until someone revokes it, so keep its budget low.
- A key can be limited to some models and combos. A request for any other model gets `403 model_not_allowed`.
- A revoked key gets `403 key_disabled`, an expired one `403 key_expired`.

## Limits on every key

Every key has a requests-per-minute limit, a tokens-per-minute limit, a cap on requests running at once, and a monthly budget. There is no key without limits. A new key gets 60 RPM, 200,000 TPM, 32 concurrent requests and US$50 per month. A workspace admin can set other limits when creating the key, within the budgets of the key's workspace and organization. The codes for each limit are in [Rate limits](https://docs.getworg.com/rate-limits#limits).

## Suspended keys

When a key spends at least US$5 in one hour and more than 10 times its hourly average of the previous 7 days, Worg suspends it and emails the organization's contact. Requests with it get `403 key_suspended`.

An owner or admin then picks one of two actions in API keys:

- Rotate: a new key with the same name, limits and expiry replaces it, and the old key is revoked.
- Resume: for a false alarm, confirmed with a two-step verification code.

A key that spikes again within 24 hours of a resume can only be rotated.

## Keep keys on your server

Call the API from your backend, never from a web page. Browsers on other sites cannot call `/v1`, and a key in front-end code can be read by anyone who opens the page.

Next: [Chat requests](https://docs.getworg.com/chat-completions) · [Errors and retries](https://docs.getworg.com/errors)