Authentication

Every request is authenticated with an API key tied to your theaimart account.

API keys

Create, name and revoke keys in the dashboard. Keys are prefixed tam_ and shown once at creation — store them securely. You can hold up to 20 active keys; only a SHA-256 hash is stored server-side, so a database leak can never expose a usable, credit-bearing key.

Bearer header (recommended)

The OpenAI-compatible way — works with every OpenAI SDK and OpenAI-compatible tool:

Authorization: Bearer tam_your_key_here

from openai import OpenAI

client = OpenAI(
    base_url="https://api.aix.theaimart.co/v1",
    api_key="tam_your_key_here",
)

X-API-Key header

Direct HTTP integrations can also send the key in an X-API-Key header:

curl https://api.aix.theaimart.co/v1/models \
  -H "X-API-Key: tam_your_key_here"

Errors

HTTP	When
`401/403`	Missing, malformed, invalid, disabled or expired key
`403`	Key policy or scope blocks the requested model/modality

Both come back in the standard OpenAI error envelope.

Security best practices

Never put a key in browser/client code — call AIx from your backend.
Give each app/environment its own named key so you can revoke independently.
Rotate by creating a new key and deleting the old one — multiple keys mean zero downtime.
Lock a key down with scopes and spend caps — see Limits, caps & scopes.

Tip: issue a scoped, capped key to CI or a teammate — e.g. chat-only, $20/day — so a leak or loop can’t drain your wallet.

← Introduction

Models →