> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trynito.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> An organization API key sent as a bearer token.

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl "https://app.trynito.ai/v1/chat/completions" \
  -H "Authorization: Bearer z_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "model": "z-ai/glm-5.2", "messages": [{ "role": "user", "content": "Hi" }] }'
```

`X-API-Key: z_sk_...` is also accepted for clients that only support an API-key header.

`GET /v1/models` and `GET /api/v1/models` return the public catalog without authentication. Credentials and organization headers do not change that list. See [List models](/api/api-reference/models-catalog/list-models).

## The Key

Keys start with `z_sk_`, belong to an organization, and grant its inference access; there are no per-key scopes. Create your first key in the developer console at app.trynito.ai. Keys with `admin: true` can also create, list, and revoke keys through the API while their owner remains an organization owner or admin. See [API keys](/api/api-reference/api-keys).

## Failures

Inference authenticates before running the model.

| Condition | Result |
| - | - |
| Missing, malformed, revoked, or expired key | `401` `unauthorized` |
| Valid key, over a request-rate limit | `429` `rate_limited` with `X-RateLimit-*` headers |
| Valid key, out of prepaid balance or allowance | `429` `insufficient_quota` |

## Other Tokens

`nito_cli_...` tokens come from `nito auth login` and are accepted on inference routes for the CLI. `nito_mcp_...` tokens are bound to the MCP endpoint and rejected by the HTTP API. Integrations use a `z_sk_` key.

## Related

* [Authentication guide](/api/get-started/authentication)
* [Headers](/api/api-reference/overview/headers)
* [Error format](/api/api-reference/overview/error-format)

## Administrative reads

[Billing balance](/api/api-reference/usage/get-balance) requires an API key with `admin: true` and current owner/admin membership, or an inference OAuth user with that membership. [Rate-limit snapshots](/api/api-reference/errors-and-rate-limits/rate-limits#inspect-current-capacity) accept ordinary API keys. These permissions are separate from inference funding and quotas.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.