Authentication - Nito

curl "https://app.trynito.ai/v1/chat/completions" \
  -H "Authorization: Bearer z_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "model": "z-ai/glm-5.2", "messages": [{ "role": "user", "content": "Hi" }] }'

X-API-Key: z_sk_... is also accepted for clients that only support an API-key header. GET /v1/models and GET /api/v1/models return the public catalog without authentication. Credentials and organization headers do not change that list. See List models.

The Key

Keys start with z_sk_, belong to an organization, and grant its inference access; there are no per-key scopes. Create your first key in the developer console at app.trynito.ai. Keys with admin: true can also create, list, and revoke keys through the API while their owner remains an organization owner or admin. See API keys.

Failures

Inference authenticates before running the model.

Condition	Result
Missing, malformed, revoked, or expired key	`401` `unauthorized`
Valid key, over a request-rate limit	`429` `rate_limited` with `X-RateLimit-*` headers
Valid key, out of prepaid balance or allowance	`429` `insufficient_quota`

Other Tokens

nito_cli_... tokens come from nito auth login and are accepted on inference routes for the CLI. nito_mcp_... tokens are bound to the MCP endpoint and rejected by the HTTP API. Integrations use a z_sk_ key.

Administrative reads

Billing balance requires an API key with admin: true and current owner/admin membership, or an inference OAuth user with that membership. Rate-limit snapshots accept ordinary API keys. These permissions are separate from inference funding and quotas.