Authentication & keys
API keys, scopes, expiry and revocation.
Every request authenticates with a bearer key:
Authorization: Bearer roar_live_...
Keys are shown once at creation and stored hashed — nobody, including us, can read one back. Treat them like passwords.
Scopes
A key always carries the inference scope (it can call /v1/*). Management scopes are opt-in per key, so the same key an app uses for AI calls can also — if you choose — manage resources through the management API:
| Scope | Allows |
|---|---|
inference | All /v1 endpoints (always present) |
keys:read | List keys (never the secrets) |
keys:write | Create and revoke keys |
usage:read | Usage, cost and budget reporting (metadata only — never prompt or response content) |
requests:read | Read a stored call's prompt and response content |
apps:read | List hosted apps and their status |
apps:deploy | Deploy, redeploy and configure hosted apps |
projects:write | Create projects and set project budgets |
A key can never grant a scope it doesn't hold itself, so a leaked low-privilege key can't mint a more powerful one.
Expiry and revocation
Keys can be created with an expiry (expiresInDays); expired keys stop authenticating with 401. Revocation from the console is immediate. Suspended accounts get 403 on every call.
Management API
Management endpoints live under https://cloud.roar-ai.com/client/* and accept the same bearer key, gated by the scopes above. The full surface is in the API reference.