Get started
Authentication
Authenticate every request with an API key from the console, in the Authorization or x-api-key header.
Every request to https://api.larasrouter.com/v1 must carry an API key. Keys belong to your organization, and every request made with a key is charged to the organization's wallet.
Send the key
Use either header. Both are accepted on every endpoint:
curl https://api.larasrouter.com/v1/models \
-H "Authorization: Bearer $LARAS_API_KEY"
curl https://api.larasrouter.com/v1/models \
-H "x-api-key: $LARAS_API_KEY"
The OpenAI SDKs send Authorization: Bearer for you. Some tools only offer an x-api-key field; that works too.
A request without a valid key fails with 401 invalid_api_key. A key that exists but lacks the chat:write scope fails with 403 insufficient_scope.
Key format
Production keys look like lr_live_<prefix>_<secret>. The console shows the full key once, when you create it. Afterwards it shows only the prefix, so you can tell keys apart without exposing them. We store a one-way hash of the secret and cannot recover a lost key — create a new one instead.
Environment variables
The official OpenAI SDKs read these variables, so many tools work without code changes:
export OPENAI_BASE_URL="https://api.larasrouter.com/v1"
export OPENAI_API_KEY="lr_live_your_key_here"
Limits on a key
Each key has its own limits, independent of your other keys:
| Limit | Default | When exceeded |
|---|---|---|
| Requests per minute | 300 | 429 rate_limit_exceeded |
| Concurrent requests | 16 | 429 concurrency_limit_exceeded |
| Monthly budget (USD) | None | 402 key_budget_exceeded |
Set a monthly budget on each key in the console so one environment cannot spend the whole wallet. See Rate limits and Billing.
Rotate and revoke
To rotate a key, create the replacement, deploy it, then revoke the old key in the console. Revocation takes effect immediately: the next request with the old key fails with 401. Your usage history keeps the revoked key's name and prefix.