Authentication

API keys

Every request to /v1/* carries an API key in the Authorization header:

Authorization: Bearer sk-siema-EXAMPLEKEYDONOTUSE0000000000000000000000

Keys look like sk-siema- followed by 40 characters. They belong to an organisation, not a user: any member of the organisation with a verified email can create one on the Keys page of the console; any member can revoke one, verified or not, so a leaked key can be cut off by whoever notices first. You can have as many keys as you like; use one per application or environment so you can revoke one without touching the others.

The console shows a key exactly once, at creation. We store only a hash. If you lose a key, create a new one and revoke the old one.

Keys work only on https://api.siema-ai.pl/v1/*. They cannot log in to the console, and console sessions or tokens cannot call the API.

Never in a browser

Treat an API key like a database password. Do not embed it in a web page, a mobile app, or anything a user can inspect. Two things make this a hard rule rather than advice:

• The gateway sends no CORS headers, so a direct call from browser JavaScript fails before it reaches the model.
• Anyone who reads the key can spend your whole balance in minutes. There is no per-key spending cap in V1.

Put a small server between your front end and siema_ai, and keep the key in that server’s environment.

Rotating a key

1. Create the new key and deploy it.
2. Confirm traffic on the old key stops (the Keys page shows last used).
3. Revoke the old key. Revocation takes effect at the gateway within one second; in-flight streams finish, new requests get 401.

If a key leaks

Revoke it immediately in the console, then email support@siema-ai.pl with the key prefix (the first 12 characters shown on the Keys page) and the approximate time of the leak. We can tell you what the key was used for; usage is logged as metadata only, so we cannot show you prompt contents.

Errors

HTTP	error.code	Meaning
401	invalid_api_key	Header missing, malformed, unknown, or the key was revoked.
403	org_suspended	The organisation is suspended. Contact support.

See Errors for the full list.