API reference
Authentication
Every public request requires a valid API key in the Authorization header.
On this page
Send the key as a Bearer token
HTTP header
Authorization: Bearer $VERBOO_API_KEYKeys are linked to the plan or prepaid balance selected at creation. That scope determines models, limits, and billing.
Secure storage
- Load the key from a secret manager or environment variable.
- Never use the key in client-side applications or public extensions.
- Do not log Authorization headers.
- Create separate keys for each application and environment.
Shown only once
Copy the secret during creation. After that, the dashboard only displays its prefix for identification.
Rotation, revocation, and expiration
- Create a new key for the same scope.
- Update the application secret and confirm a successful request.
- Revoke the old key in the dashboard.
A revoked or expired key, or a key without an active plan or balance, can no longer authorize requests.
Authentication errors
| Status | When it happens | Action |
|---|---|---|
| 401 | The key is missing, invalid, expired, or revoked. | Check the header and rotate the key. |
| 402 | The prepaid balance is insufficient. | Add funds before retrying. |
| 403 | The plan or model does not allow the requested feature. | Review the scope and capabilities. |
| 428 | The current terms version still needs to be accepted. | Open the acceptUrl returned in the response. |