Authentication

SupaNexus uses Bearer API key authentication, compatible with OpenAI client libraries.

Header format

Authorization: Bearer <API_KEY>

Include your API key secret in the Authorization header. SupaNexus validates the key on every request.

Creating an API key

1. Sign in to the Developer Console.
2. Open your organization → project → API Keys.
3. Create a key and copy the secret immediately (shown once).

Each key is scoped to a project and organization. Usage is metered against that project.

Expiration

If the key has an expiration timestamp and is past due, requests return 401:

{
  "error": {
    "code": 401,
    "message": "Invalid credentials. Provide a valid API key in the Authorization header."
  }
}

Missing or invalid key

Suspended account check

After the API key is validated, SupaNexus also checks the organization owner’s platform account status:

Suspension is applied by a platform administrator. After unsuspension, console and API access resume. API keys are not auto-revoked, but the API rejects every request while the account is suspended.

{
  "error": {
    "code": 403,
    "message": "Your account has been suspended. Contact support for assistance."
  }
}

Do not retry this error; contact SupaNexus support or your administrator.

What authentication does not cover

• IP rate limiting on /v1/* also returns OpenRouter-style 429 — see Rate Limits & Quotas.
• Usage quota and account balance checks may run after authentication on POST /v1/chat/completions and POST /v1/messages, depending on your deployment.

Security recommendations

• Store keys in environment variables or a secrets manager, never in source control.
• Rotate keys periodically and revoke unused keys in the console.
• Use separate keys per environment (dev/staging/production).