Authentication

The key

A key looks like xpl_ followed by 40 lowercase hex characters and belongs to exactly one organization. The secret is shown once, at creation, so copy it then. Mint keys signed in at Settings, API keys. Creating and revoking keys is a web-session action, not something an API key can do.

Export the key for the snippets throughout these docs: export EXPLABS_API_KEY=xpl_...

The header

Send the key as a Bearer token on every request: Authorization: Bearer <key>. There is no query-string key and no cookie. Verify a key works by listing the models it can call:

curl "https://api-pr-884.preview.experientiallabs.ai/v1/models" \
  -H "Authorization: Bearer $EXPLABS_API_KEY"

The one exception is the public catalog. The catalog reads (GET /api/models*) are keyless: without a key you get the public rows, and sending your key adds the rows your organization owns. Everything else, including the OpenAI-compatible GET /v1/models, requires your key.

What one key can do

The same Bearer key that runs inference also reaches the management surface an agent needs. Every write acts for the key's own organization; tenancy scopes each call to it. With one key you can:

• Call models on /v1 (Chat Completions, Responses, and Anthropic Messages).
• Read the catalog and your org's custom and local models.
• Create custom and local models and edit provider waterfalls.
• Connect and verify BYOK provider connections (secrets are write-only).
• Read your usage, spend, and the org's key list.

A customer key deliberately cannot:

• Mint or revoke API keys: that is a web-session action (POST /api/keys is not key-callable).
• Change another key's limits.
• Reach platform-admin routes.

When auth fails

A missing, malformed, expired, or revoked key returns a uniform 401 with code=invalid_key; the response does not distinguish which of those it was.

{
  "error": {
    "message": "The API key is missing, invalid, or has been revoked.",
    "type": "authentication_error",
    "code": "invalid_key",
    "param": null
  }
}

Fix the Authorization header rather than retrying; the same call fails the same way. On /v1/messagesthe same failure arrives in Anthropic's envelope instead. See Errors for every code.

See also

Walk the full self-serve loop in The core loop, or read the complete surface in the API reference. Agents can read /llms.txt for the same contract in one file.