Authentication
Protect keys and use the correct headers.
Keep API keys in environment variables. Never put keys in source code, URLs, screenshots or logs. Send them only to trusted servers and rotate exposed keys.
Install the libraries used by the example, use a supported runtime and set STALI_API_KEY in the environment. Replace sample model names with an available model matching the protocol.
Authentication
Both auth header styles are accepted — use either:
Send one authentication method. If both headers are present, x-api-key takes priority; an invalid key there can cause 401 even when the Bearer key is correct.
x-api-key: sk-mtm-...
Authorization: Bearer sk-mtm-...The new key is saved as a hash code for authentication and AES-256-GCM encryption so that the owner can view or copy it back in the control panel. Old keys created before this feature cannot be restored. Each account can have a maximum of 10 active keys at the same time.
Create a separate key per machine or app: if a key leaks, you only revoke that one, and the Usage page can split cost by key. Do not paste keys into source code pushed to Git — put them in environment variables or a config file outside the repository.
Examples receive source review and local checks; this does not establish compatibility with every app version. Check settings, send a small request and confirm usage before production use.