Skip to main content
Send your key as a bearer token on every request, in the Authorization header:
A request without a valid key gets 401 unauthenticated.
On a shared host, keep the key out of the command line, where other users can see it in the process list: put the header in a file only you can read, and pass it with curl -H @header.txt.

​
Keys

  • A key belongs to one lab. Your lab can hold several, for example one per cluster or per person, and each can be revoked on its own.
  • AICME issues keys. Ask us for a new one, or to revoke one. A revoked key gets 401 from then on.
  • We show a key once, when we hand it over, and we keep only a hash of it. Store it in your secret manager. Don’t put it in git, in a Docker image, or in a log.
  • The package’s verifier reads the key from its environment (AICME_API_KEY). It is never written into a package.

​
What a key can see

Your key sees your lab’s own resources, and nothing else:
  • Tasks your lab is granted. A task that isn’t granted returns 404, the same response as a task that doesn’t exist. A 404 never tells you whether a task exists.
  • Rewards your lab created. Another lab’s reward returns 404.
Your lab comes from the key, never from the request: nothing you send can act as another lab.