Authentication

Every endpoint except GET /v1/models needs an API key. Send it in either of these headers. Both work on every endpoint, so use whichever your client sends:

Authorization: Bearer $YOUR_KEY, which OpenAI SDKs and most tools send.
x-api-key: $YOUR_KEY, which Anthropic SDKs send.

Placeholders: $API_BASE is https://api.abliteratedllm.dev/v1, $API_ORIGIN is https://api.abliteratedllm.dev, and $YOUR_KEY is your API key.

# OpenAI style
curl $API_BASE/balance -H "Authorization: Bearer $YOUR_KEY"

# Anthropic style
curl $API_BASE/balance -H "x-api-key: $YOUR_KEY"

API keys

Create, rename, edit and revoke keys in API keys, which also shows when each key was last used (to within a few minutes) and what it has spent.

A key is sk- followed by 48 letters and digits.
It is shown once, when you create it. We store only a keyed hash of it, so we can't show it again. The dashboard identifies keys by their first 10 characters.
An account can have up to 20 active keys. Revoke one to make room for another.
Key creation is limited to 30 attempts an hour per account. Further attempts get 429 rate_limit_exceeded with a Retry-After header.
Revoking a key takes effect within 30 seconds.
A key can have an expiry date. It stops working at 00:00 UTC on that date, and requests then get 401 invalid_api_key with the message This API key expired on 2026-12-31 00:00 UTC. Until you revoke it, you can give an expired key a later date to use it again.
The playground uses its own key, which is managed for you and doesn't appear in the list.

Spend caps

Each key can have a daily cap, a monthly cap and a lifetime budget, in any combination. Days and months are UTC; the lifetime budget counts what the key has spent since lifetime budgets were introduced (for older keys, only their last 30 days of usage before that). Before a request is forwarded, its maximum possible cost (the hold described in Rate limits and trial) is added to what the key has already spent in the period. If that total exceeds a cap, the request fails with 402 key_spend_cap_reached and nothing is charged; the message names the cap (daily, monthly or lifetime). Caps are a good way to give a script or a teammate a key with a fixed budget. GET /v1/balance reports what is left of each.

Account number and API keys are separate

Your 16-digit account number logs you in to the website. It never works as an API key, and an API key can't log in to the website. Keep both secret: anyone holding the account number controls the account and its credit.

Errors

The account's status is checked before anything else in the request.

Status	Code	Meaning
401	`invalid_api_key`	No key was sent, or the key is malformed, unknown, revoked or expired.
403	`account_suspended`	The account is suspended. Every key on it is refused until the suspension ends.
403	`account_banned`	The account is banned. Its keys are revoked and the remaining credit is forfeit.

The full list is on the Errors page.

Request ids

Every response, including errors, carries an x-request-id header. Quote it when you contact support or report a problem. It lets us find the request's metadata (time, key, model, token counts, cost, status and latency), which we keep for 30 days. We don't store prompts or outputs (see the privacy policy), so the request id is the only way to point at a specific request.