Start
Authentication
Send your API key as a Bearer token or in x-api-key. Keys belong to an organization and can carry budgets and model limits.
Every request needs an API key. Send it in one of two headers:
| Header | Format |
|---|---|
Authorization | Bearer nh_live_... |
x-api-key | nh_live_... (what the Anthropic SDKs send) |
curl https://api.notholy.com/v1/models -H "x-api-key: $NOTHOLY_API_KEY"Keys
Keys are created in the console under API keys. Each key belongs to an organization and a workspace. The secret is shown once and stored only as a hash.
A key can have:
- A total budget and a daily budget in USD. A request that would pass the budget gets
402. - A list of allowed models. Other models get
403 key_not_allowed. - An expiry date.
- A requests-per-minute limit below the organization limit.
Revoking a key takes effect on the next request.
Keys in code
Read the key from the environment. Do not commit it. If a key leaks, revoke it in the console and create a new one.
Never ship a key in client-side code. Call the API from your server or your terminal and keep keys in environment variables or a secret store.
import os
from openai import OpenAI
client = OpenAI(base_url="https://api.notholy.com/v1", api_key=os.environ["NOTHOLY_API_KEY"])
print([m.id for m in client.models.list()])Errors
| Status | Code | Meaning |
|---|---|---|
| 401 | invalid_api_key | Missing, wrong, revoked or expired key |
| 403 | key_not_allowed | The key cannot use this model |
| 403 | account_suspended | The organization is suspended. Contact support |
| 403 | consent_required | The key's creator refused or withdrew consent to processing in the United States and China. They can accept it in the console |