Keys, accounts and headers.

Failure ID accounts

A Failure ID is the account behind your keys. It supports:

• Email and password (hashed with PBKDF2).
• TOTP two-factor authentication with one-time recovery codes.
• Passkeys (WebAuthn).
• GitHub and Google sign-in, enabled once configured.
• Revocable sessions, listed in the console.
• An account audit log of sign-ins, key changes and security events.

Sign-up is invite-only. Use the invite key (or invite link) the lab sent you; the account it creates is ready to make API keys straight away. No key? Ask on the contact page.

API keys

Create keys in the Console. The full key is displayed once, at creation. We keep a hash, so we cannot show it to you again and nobody at the lab can read it. Make one key per app or environment, so you can cap and revoke them independently.

Sending the key

Either header works. Use one, not both.

# Standard bearer token — what the OpenAI SDKs send
curl https://api.failure.fail/v1/models \
  -H "Authorization: Bearer $FAILURE_API_KEY"

# Or the x-api-key header
curl https://api.failure.fail/v1/models \
  -H "x-api-key: $FAILURE_API_KEY"

With the OpenAI SDKs, pass the key as api_key / apiKey and it is sent as a bearer token.

from openai import OpenAI
client = OpenAI(base_url="https://api.failure.fail/v1", api_key=os.environ["FAILURE_API_KEY"])

Public endpoints

GET /v1/pricing and GET /v1/status need no key. Everything else does.

When auth fails

A missing, malformed or revoked key returns 401:

{ "error": { "message": "Invalid API key.", "type": "invalid_api_key" } }

Do not retry a 401. Check the key, then check that it has not been revoked in the console.

Rotating a key

1. Create a new key in the console.
2. Deploy it everywhere the old key is used.
3. Revoke the old key. Revocation is immediate.