Authentication

Requests authenticate with an API key in the Authorization header.

Header

Authorization: Bearer hlk_0123...

curl https://citadel.albastov.com/v1/models -H "Authorization: Bearer $CITADEL_API_KEY"

• The scheme name Bearer is case-insensitive.
• Citadel ignores keys in query strings and cookies.

Keys

An LLM key is hlk_ followed by 64 hex characters. An account key on the LLM routes fails with 401 invalid_api_key.

Getting a key

• The owner of albastov.com issues keys. Request a key with a label and a daily limit.
• A key is shown once, at creation. Store the key in a secret manager or an environment variable.
• Use one key per person or program.
• A revoked key fails with 401 invalid_api_key immediately.
• For a leaked key, request a new key and the revocation of the leaked key.

Errors

Both responses include WWW-Authenticate: Bearer.

Daily limit

An LLM key is limited to a number of chat completion calls per UTC day: 200 by default. Open calls count toward the limit. GET /v1/models does not count.

{
  "error": {
    "message": "This key's daily limit of 200 calls is used up; it resets at 00:00 UTC",
    "type": "rate_limit_exceeded",
    "code": "daily_limit",
    "limit": 200,
    "used": 200
  }
}

Retry-After counts down to 00:00 UTC. All limits: Rate limits.

Session routes

The albastov.com LLM lab uses session routes. A session route accepts an albastov.com sign-in session instead of a key. Use the key routes in your own code.

The owner session has no token or concurrency limit.