Authentication - Momor Gateway docs

Send your key

Put the key in the Authorization header of every call. The model catalogs need no key, so you can read them before you have one.

Authorization: Bearer $MOMOR_API_KEY
Content-Type: application/json

RouteWhat it takes

POST /models, /models/chat, /models/two, /models/decision, /models/transcribe

An API key

GET /models/requests/{requestId}

An API key

POST /v1/chat/completions, /models/completions, /v1/audio/transcriptions

An API key, or a signed-in Momor session

GET /models, /models/chat, /models/two, /models/decision, /models/transcribe, /v1/models

Nothing

Where keys come from

A Gateway organization’s owner creates its API keys, while signed in: in Settings › API keys, or with the call below. A Search account holds no API keys, and the call is refused with 403 there. A Workflow organization’s API keys start and answer its workflow runs; /models and /v1 refuse them with 403, so only a Gateway organization’s API keys call models. No Gateway organization yet? Create one.

POSThttps://api.momor.ai/organization/apikeys

namestringRequired: What the key is for, so you can tell your keys apart.
expiresAtdate-time: When the key stops working. Leave it out for a key that works until it is revoked.

The answer is 201 with the key as apikey. It is shown only in this answer; Momor can’t show it again.

{ "apikey": "…" }

Keep keys on your serverAnyone with the key can spend your organization’s credits. Don’t put it in a browser or a mobile app.

Listing and revoking keys

GET /organization/apikeys lists the organization’s keys newest first, revoked ones included, a page at a time: skip passes over that many keys (0 by default) and take sets how many a page holds, from 1 to 200 (50 by default). The answer is { "count", "items" }: how many keys the organization holds, and the page, each key with its id, name, expiresAt, revokedAt and lastUsedAt. DELETE /organization/apikeys, with the key as a JSON string in the body, revokes it and answers 204; from then on the key is refused. Both are for the owner, signed in.

When a key is refused

A missing, revoked or expired key, or a value that is not a Momor key, is answered 401 before the call is routed. On the OpenAI-compatible routes the body is OpenAI’s error object:

{ "error": { "message": "The API key was refused.", "type": "authentication_error", "param": null, "code": "invalid_api_key" } }

A Workflow organization’s API key is answered 403 on /models and /v1: its keys start, answer and read workflow runs only.

Each key is counted on its own for rate limits, and every call it makes is recorded under the organization; see usage and costs.