Authentication

API authentication — API keys, scopes, headers.

GET /api/v1/models
X-API-Key: ll_xxxxxx

Scopes

traces:read, traces:write, replay:execute, feedback:write, feedback:read, admin, ingest.

Errors

• 401 missing or invalid key
• 403 valid key but missing scope

Browser security: keys are server-side only

API keys must never appear in browser code. Stratix does not emit CORS headers, so browser-direct calls are blocked by preflight regardless. Always proxy through your own backend — see the calling Stratix from a backend guide.

See also

• API keys
• SDK auth