API authentication
Authenticate every request with a project API key sent as a bearer token.
Bearer keys
curl https://api.inferencebureau.com/v1/balance \
-H "Authorization: Bearer $IB_API_KEY"x-api-key: $IB_API_KEY works too, as the Anthropic SDK sends it. If both are sent, Authorization wins.
The key fixes the team, project, and environment for the request. Nothing in the request body or headers can change them.
Key format
Keys start with ib_live_ (a production environment) or ib_test_ (development), followed by a random secret. The prefix is a label: both work on every inference endpoint and are billed the same way. Keys are shown once at creation; create and revoke them on a project's API Keys page. See Authentication for how keys relate to projects.
Failures
A missing, malformed, unknown, revoked or expired key returns 401 invalid_api_key. A key whose project or environment is disabled returns 403 policy_denied, and a suspended team 403 account_suspended. Keys are checked on every request, with no caching, so a revoked key stops working on its next request. The Auditor repository routes also need a key with Auditor Permissions, and answer 403 policy_denied to any other key. The MCP server at POST /v1/mcp takes any key of the team, but its preview_deploy and resolve_finding tools need Auditor Permissions too.
Management keys
The management API (/v1/keys, /v1/projects, /v1/team/directives and the /directives of each project, environment and key, /v1/webhooks) takes a team management key, ib_mgmt_…, as a bearer token, and nothing else: a project key there gets 403 policy_denied. A management key anywhere else gets 401 invalid_api_key. Create them under Team → Management keys. PATCH /v1/team/directives also needs the key's Team Directives permission, chosen when it is created (off by default); without it the call gets 403 policy_denied.