Tarseek API · Pre-production
Authentication
API keys
Authenticate every inference request with a project API key. Send it as a bearer token:
Authorization: Bearer trsk_live_...Create and revoke keys in the dashboard under the project’s API keys page. Store keys in a secret manager. Never embed them in client-side apps.
Implemented
Gateway auth reads
Authorization: Bearer and looks up project_api_keys. Prefixes trsk_ and legacy trsq_ are accepted. Cookie sessions are for the dashboard only and must not be used for /v1/chat/completions.Missing or invalid keys
| Condition | Production contract | Today |
|---|---|---|
| No Authorization header | 401 authentication_required | Implemented — includes a Bearer WWW-Authenticate challenge |
| Malformed or unknown key | 401 invalid_api_key | Implemented — same code |
| Disabled / revoked key | 401 api_key_revoked | Implemented — api_key_revoked |
| Expired key | 401 api_key_expired | Implemented — api_key_expired |
Permissions and scopes
Keys support inference, models:read, files:read, files:write and requests:read. File references inside inference require file-read permission. Existing keys retain their permissions; new dashboard keys default to inference and model discovery. Manage scopes, budgets and alerts.