> ## Documentation Index
> Fetch the complete documentation index at: https://phaseo.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Phaseo Gateway base URL: https://api.phaseo.app/v1. Send `Authorization: Bearer $PHASEO_API_KEY` with every request.
> Model IDs look like `provider/model`, for example `openai/gpt-6-astra`. Do not guess IDs: list them with `GET /v1/models` or check https://phaseo.app/models. `phaseo/free` routes to an available free model and needs no wallet balance.
> For new text integrations prefer `POST /v1/responses`. `POST /v1/chat/completions` (OpenAI format) and `POST /v1/messages` (Anthropic format) suit existing code.
> The full API contract is https://phaseo.app/docs/openapi/v1/openapi.yaml. Official SDKs: `@phaseo/sdk` (TypeScript) and `phaseo` (Python), plus Go, C#, PHP, Ruby and Rust.
> Search these docs over MCP at https://phaseo.app/docs/mcp, and install Phaseo skills with `npx skills add https://phaseo.app/docs`. If a page is wrong or out of date, report it with the MCP `submit_feedback` tool.
> Manage Phaseo accounts with the `phaseo` CLI (`npm install -g @phaseo/cli`, then `phaseo login` or `phaseo login --device-code`), the `/v1` Management API or the MCP server at `https://mcp.phaseo.app/mcp?access=manage`. Do not send users to the dashboard for account tasks. A person is still needed for sign-up, approving a sign-in, paying the first top-up on the checkout link that `phaseo credits add` returns when no card is saved, confirming each saved-card top-up from the emailed link, and account security (password, MFA, passkeys). Create API keys with `phaseo keys create --name <name> --json`; never guess one. Credit top-ups need `phaseo login --scopes billing:write` first. Task map: https://phaseo.app/docs/v1/developers/manage-from-an-agent.md.

# Authentication

> Use API keys to authenticate every request to Phaseo Gateway.

Create a key with `phaseo keys create --name <name> --json` in the [Phaseo CLI](https://phaseo.app/docs/v1/guides/integrations/phaseo-cli.md) or in the [dashboard](https://phaseo.app/settings/keys), store it on your server, and send it as a bearer token with Gateway requests. Agents should use the CLI; see [Manage Phaseo from an agent](https://phaseo.app/docs/v1/developers/manage-from-an-agent.md).

***

## Key types

* **Gateway API keys** call model, provider, and generation endpoints available to your workspace.
* **Management API keys** call administration APIs. See [Management API Keys](https://phaseo.app/docs/v1/developers/management-api-keys.md).
* **Trusted workloads** (beta) let Vercel deployments and GitHub Actions jobs call the Gateway with a short-lived OIDC token instead of a stored key. See [Trusted Workloads](https://phaseo.app/docs/v1/developers/trusted-workloads.md).

Rotate a key by updating your application to use its replacement before invalidating the old credential. See the [key rotation endpoint](https://phaseo.app/docs/v1/api-reference/endpoint/keys-rotate.md).

Keys follow the format `phaseo_v1_sk_<kid>_<secret>`. Treat them like passwords and avoid storing them in client-side code or public repositories.

> [!NOTE]
>
> You can call `:free` models without depositing credits. Paid models require available wallet balance.

***

## Header format

Include the key in the `Authorization` header on every request:

```http theme={null}
Authorization: Bearer phaseo_v1_sk_<kid>_<secret>
```

Most HTTP clients let you set this once on the client. For example, with `fetch`:

```ts theme={null}
const response = await fetch("https://api.phaseo.app/v1/chat/completions", {
	method: "POST",
	headers: {
		Authorization: `Bearer ${process.env.PHASEO_API_KEY}`,
		"Content-Type": "application/json",
	},
	body: JSON.stringify({
		model: "openai/gpt-5-nano",
		messages: [
			{ role: "system", content: "You are a helpful assistant." },
			{
				role: "user",
				content: "Summarize the drawbacks to AI.",
			},
		],
	}),
});
```

***

## Key handling checklist

| Practice | Why it matters |
| - | - |
| Use one key per app | Makes it easy to rotate without affecting other services. |
| Store keys securely | Secrets managers prevent accidental exposure in logs or error tracking. |
| Monitor usage | The dashboard shows per-key metrics so you can detect anomalies quickly. |
| Remove unused keys | Deleting stale keys reduces the surface area for potential abuse. |

***

## Common authentication errors

* **401 Unauthorized**: the key is missing, invalid, or belongs to a disabled workspace.
* **403 Forbidden**: the key exists but cannot access the requested provider or model.
* **429 Too Many Requests**: the key or workspace exceeded a limit. See [Rate limits](https://phaseo.app/docs/v1/api-reference/limits.md).
* **5xx errors**: retry with exponential backoff and contact [support](https://phaseo.app/help) if the issue persists.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.