Authentication
Send your Cruxy API key as a Bearer token in the Authorization header on every authenticated request.
Every authenticated endpoint reads one header: Authorization: Bearer
followed by your cxy_live_ key. To mint a key, confirm it works, and store it
safely, see Get your API key.
The Authorization header
Send the key on every authenticated request:
curl https://api.cruxy.ai/api/v1/me \
-H "Authorization: Bearer $CRUXY_API_KEY"const res = await fetch('https://api.cruxy.ai/api/v1/me', {
headers: { Authorization: `Bearer ${process.env.CRUXY_API_KEY}` },
})
console.log(res.status, await res.json())The same key and header work on the OpenAI-compatible routes,
POST /v1/chat/completions and GET /v1/models: point an OpenAI client at the
base URL https://api.cruxy.ai/v1 and give it your Cruxy key as its API key.
Migrate from OpenAI covers the rest of the
switch.
Endpoints that take no key
These endpoints are public:
| Endpoint | Why it is public |
|---|---|
POST /api/v1/device/code, POST /api/v1/device/token | Device login issues keys. |
POST /api/v1/auth/oauth/start, POST /api/v1/auth/oauth/token | Native sign-in issues keys. |
GET /api/status, GET /api/health, GET /api/ready | Platform status and health probes. |
When the key is rejected
A 401 unauthorized means the key is missing, malformed, unknown, expired,
or revoked: the same answer for each. A signed-in key stops working at its
expires_at; see Expiry and revocation.
Check the Authorization header, then
verify the key.
A 403 means the key is valid but its authority does not cover the call:
code | Meaning |
|---|---|
key_scope_forbidden | The key is not scoped for this endpoint family, or for the memory, rules, or files feature a request field asked for. |
model_not_allowed | The key's model allowlist excludes the requested tier. |
key_read_only | The key may not perform billable operations. |
A 403 never clears by waiting: re-scope the key or issue a new one.
Errors and retries lists every error code.
Next steps
- Get your API key: device login, key format, and key hygiene.
- Chat: make an authenticated chat call.
- API Reference: which endpoints require a key.