Authentication and API keys
Create project keys in the dashboard, store them as server-side secrets, and send them as bearer tokens to protected model and utility endpoints.
Use the dashboard whenever you need to reveal, pause, resume, revoke, scope, or limit a key. Client applications should call your own backend, not expose VIABLE Lab API keys directly.
Key details
Authorization- Bearer $VIABLE_API_KEY for protected API calls
Scopes- model:request for model endpoints, utils:crypto for encryption utilities, agents:execute for published agent runs
Optional limits- requests per minute, daily token cap, monthly cost cap
- Optional allowedModels list to restrict a key to exact model IDs or aliases
Notes
- Bearer keys do not change request bodies.
- Paused keys can be resumed without rotation. Revoked keys are permanent.
- Dashboard management endpoints are for signed-in dashboard sessions, not normal product integrations.
Authorization: Bearer $VIABLE_API_KEY