Authentication

Authenticate every API request except health checks with a scoped project API key.

Use an API key

Send the key as a bearer token on every authenticated request. Keys are scoped to a project and environment, so use distinct keys for development and production.

curl https://api.use-allm.com/v1/deployments?limit=1 \
  -H "Accept: application/json" \
  -H "Authorization: Bearer $ALLM_API_KEY"

SDK configuration

import { ALLM } from "@allm/sdk";

const allm = new ALLM({
  apiKey: process.env.ALLM_API_KEY,
  timeoutMs: 10_000,
});

import os
from allm import ALLM

allm = ALLM(
    api_key=os.environ["ALLM_API_KEY"],
    timeout=10.0,
)

Keep keys secure

• Load keys from a secrets manager or environment variable.
• Rotate a key immediately if it may have been exposed.
• Use the narrowest project and environment scope available.
• Do not use a production key in local development or CI logs.

Troubleshooting