Authentication and API Keys

Every /v1/* endpoint authenticates with an API key. Keys start with gk_ and are created on the API Keys page of your region's console (China region https://cn.inf.space, international region https://ai.inf.space). A key is shown in full only once, at creation — save it immediately; afterwards the console shows only its prefix.

Sending the Key

Pass the key in the Authorization header with the Bearer scheme:

Authorization: Bearer gk_xxxxxxxxxxxxxx

# Global region; China region is https://cn.inf.space (accelerated) or https://global.inf.space (international)
curl "https://ai.inf.space/v1/chat/completions" \
  -H "Authorization: Bearer $INFERENCE_SPACE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-5.6-sol",
    "messages": [{ "role": "user", "content": "Hello" }]
  }'

import os
import requests

resp = requests.post(
    # Global region; China region is https://cn.inf.space (accelerated) or https://global.inf.space (international)
    "https://ai.inf.space/v1/chat/completions",
    headers={"Authorization": f"Bearer {os.environ['INFERENCE_SPACE_API_KEY']}"},
    json={
        "model": "gpt-5.6-sol",
        "messages": [{"role": "user", "content": "Hello"}],
    },
    timeout=600,
)
print(resp.status_code, resp.json())

// Global region; China region is https://cn.inf.space (accelerated) or https://global.inf.space (international)
const resp = await fetch("https://ai.inf.space/v1/chat/completions", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.INFERENCE_SPACE_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    model: "gpt-5.6-sol",
    messages: [{ role: "user", content: "Hello" }],
  }),
});
console.log(resp.status, await resp.json());

• The Bearer prefix is required; a bare Authorization: gk_... is treated as no key at all.
• The x-api-key: gk_... header used by the Anthropic SDK / Claude Code also works; if both headers are present, Authorization wins.
• With the OpenAI or Anthropic SDK, just set the SDK's api_key; the SDK puts it in the right header.
• A key only works in its own region: China-region keys use cn.inf.space / global.inf.space, international-region keys use ai.inf.space.

Capability Scopes

Each key is granted "capabilities" in the console, each mapping to a scope. To call an endpoint, the key must hold that endpoint's scope (or the wildcard ai:*).

Per-Key Access Restrictions

Beyond scopes, the console can put the following restrictions on each key. A request that violates one gets 403:

Authentication Errors

Authentication failures return 401 or 403 with a JSON body. The body shape differs slightly by endpoint family:

Image, speech, OCR, vision segmentation, video, and similar endpoints: the error code is in error.type.

{
  "error": {
    "message": "API key lacks scope for /v1/images/generations",
    "type": "insufficient_scope"
  }
}

Chat endpoints (/v1/chat/completions, /v1/responses):

{
  "error": {
    "code": "authentication_required",
    "message": "无法识别 API 密钥，请检查认证信息后重试。"
  }
}

/v1/messages (native Anthropic protocol): an invalid key or missing scope returns the Anthropic format {"type": "error", "error": {"type": "authentication_error", "message": "..."}}.

Troubleshooting:

• missing_api_key: make sure the request carries Authorization: Bearer gk_... with one space between Bearer and the key, and that your environment variable is actually loaded.
• invalid_api_key / authentication_required: check that the key is not mistyped, expired, or revoked, and that it belongs to the region you are calling; for chat endpoints also check that it has ai:llm.
• insufficient_scope: add the capability to the key in the console, or use a key with sufficient permissions.
• ip_not_allowed: the error message includes the source IP the gateway saw; add it to the key's IP allowlist.

Recommendations

• Keep keys on the server side; never ship them to browsers, mobile apps, or frontend code.
• If a key may have leaked, revoke it in the console immediately and create a new one.
• Avoid sharing one ai:* key long-term.

See Quick Start and Error Codes and Error Handling.