Guides
Authentication
Create an API key and authenticate requests to RunAPI.
RunAPI uses API keys to authenticate API requests. Send the key with every request that accesses your account or creates work.
Choose the right key
- A standard API key calls the Task API, LLM API, and account endpoints. Create it from the API Keys page.
- A management key creates and governs standard API keys and guardrails. Create it from the Management Keys page and use it only with Platform Management endpoints.
Create an API key
Give each application its own key so you can rotate or revoke access without interrupting other integrations. A key is bound to one account, and requests can access only resources visible to that account.
Authenticate a request
Send the API key as a bearer token in the Authorization header:
HTTP
Authorization: Bearer YOUR_API_TOKEN
For example, request your current balance with cURL:
SHELL
curl "https://runapi.ai/api/v1/me/balance" \
-H "Authorization: Bearer YOUR_API_TOKEN"
Keep keys secure
- Store API keys in a secret manager or encrypted credentials.
- Never commit a key to source control or expose it in browser code.
- Rotate a key immediately if it may have been disclosed.
- Use separate keys for development and production.
Troubleshoot authentication
- A
401 Unauthorizedresponse means the key is missing, malformed, revoked, or invalid. - A
403 Forbiddenresponse means the key is valid but its credential class or account role cannot perform the operation. - Confirm the header starts with
Bearer, followed by one space and the complete key. - Confirm the key belongs to the account whose resources you are requesting.