> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trynito.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys and how to use them.

## Keys

Keys are created in the developer console at [app.trynito.ai/api](https://app.trynito.ai/api) by an owner or admin. The secret is shown once; the gateway keeps only a hash. Lost a key? Revoke it and create another.

A key belongs to an organization, and inference usage is metered against that organization. A personal account is its own organization. Keys have no per-feature scopes; the way to bound one is an optional daily, monthly, or overall spend cap, set at creation. When the cap is reached the key stops working.

API access is prepaid. See [Plans](/plans).

## Public Model Discovery

`GET /v1/models` and `GET /api/v1/models` are public. They return the same catalog with or without credentials or an organization header. Browsing the catalog requires no prepaid balance. Inference requests still require authentication and account eligibility. See [List models](/api/api-reference/models-catalog/list-models).

## Sending the Key

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl "https://app.trynito.ai/v1/chat/completions" \
  -H "Authorization: Bearer z_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "model": "z-ai/glm-5.2", "messages": [{ "role": "user", "content": "Hi" }] }'
```

`Authorization: Bearer <key>` is the header; `X-API-Key: <key>` is also accepted for clients that only support an API-key header. On routes that require authentication, a missing, malformed, revoked, or expired key returns `401`. Rate limits are checked in the same step: over a limit returns `429` with `Retry-After`, `X-RateLimit-Limit`, `X-RateLimit-Remaining`, and `X-RateLimit-Reset`.

## Token Prefixes

| Prefix | Type | Used for |
| - | - | - |
| `z_sk_` | Organization API key | The HTTP API. |
| `nito_cli_` | CLI access token | Issued by OAuth to the `nito` command line tool. See the [CLI reference](/plugin/cli/reference). |
| `nito_mcp_` | MCP access token | Issued by OAuth to MCP clients on `app.trynito.ai/mcp`. |

CLI tokens are accepted on the inference routes. MCP tokens are bound to the MCP endpoint and rejected elsewhere.

## Errors

* **401.** Check the prefix is `z_sk_` and there is one space after `Bearer`.
* **An MCP token on the HTTP API.** Use a `z_sk_` key.
* **A key in source control.** Keys are full organization credentials. Keep them in environment variables or a secrets manager; rotate by revoking and recreating.

## Related

<CardGroup cols={3}>
  <Card title="Developer Console" icon="terminal" href="/web-app/developer-console">
    Keys, usage, playground.
  </Card>

  <Card title="Secure API Key Handling" icon="lock" href="/api/features/best-practices/secure-api-key-handling">
    Store, cap, rotate.
  </Card>

  <Card title="Rate Limits" icon="gauge" href="/api/api-reference/errors-and-rate-limits/rate-limits">
    The limit headers.
  </Card>
</CardGroup>

## Automating key management

An owner or admin can create a key with **Admin access** in the developer console, then use it to [create, list, and revoke API keys](/api/api-reference/api-keys). Ordinary inference keys default to `admin: false`. Keep the admin credential separate from application keys; newly created keys have independent spend caps and expiry.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.