Authentication

Every request to a metered endpoint is authenticated with an api14 API key, sent as a Bearer token in the Authorization header.

Authorization: Bearer sk-api14-...

The OpenAI SDKs set this header for you from the apiKey / api_key option.

API keys

Create and manage keys in API keys.

• Keys start with sk-api14- and are shown once, when you create them. Only a hash is stored, so a lost key cannot be recovered, create a new one and revoke the old one.
• Each key can have its own requests-per-minute limit, daily USD spend limit and model allowlist. See Rate limits.
• The number of keys you can hold depends on your plan: 1 on Free, 10 on Pro, more on Team and Enterprise.
• Revoking a key takes effect immediately; requests with it return 401 invalid_api_key.

Using a key

Keep the key in an environment variable and read it in code:

export API14_API_KEY="sk-api14-..."

curl https://api14.com/api/v1/chat/completions \
  -H "Authorization: Bearer $API14_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "openai/gpt-5-mini", "messages": [{"role": "user", "content": "Hello"}]}'

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://api14.com/api/v1",
  apiKey: process.env.API14_API_KEY,
});

const result = await client.chat.completions.create({
  "model": "openai/gpt-5-mini",
  "messages": [
    {
      "role": "user",
      "content": "Explain vector databases in two sentences."
    }
  ]
});
console.log(result.choices[0].message.content);

Endpoints without a key

These read-only catalog endpoints work without authentication:

Everything else, generation endpoints, /credits, /key, /generation and video job status, requires a key.

Authentication errors

A missing, malformed or revoked key returns:

{
  "error": {
    "message": "Missing or invalid API key. Use \"Authorization: Bearer sk-api14-…\".",
    "type": "authentication_error",
    "code": "invalid_api_key"
  }
}

with HTTP status 401. A key restricted by its allowlist returns 403 model_not_allowed for other models. See Errors.

Keeping keys safe

• Never put a key in browser or mobile app code, anyone can read it there. Call api14 from your server.
• Never commit keys to source control. Use environment variables or a secret manager.
• Use one key per app or environment, so you can revoke one without breaking the others.
• Set a daily USD limit on keys used by scripts or less trusted services, so a bug cannot drain your balance.
• If a key leaks, revoke it in API keys right away.