---
title: Authentication and permissions
description: Create an API key, send it securely, and understand its model and account boundaries.
lastUpdated: 2026-09-08
---

Create an API key in **Console → Token Management → Add Token**. Keep it private and send it as an HTTP request header:

```text
Authorization: Bearer YOUR_API_KEY
```

## What a key can do

A key can query available models and call models allowed by its group, consuming the account's balance according to the model's rate. It cannot change your login password, retrieve the complete recharge history, or withdraw funds; those actions require the signed-in website.

## Store and use keys safely

Keep keys on your server rather than in public HTML, frontend JavaScript, mobile packages, screenshots, or repositories. Use a separate key where you need separate client control, and configure a quota appropriate to your needs in Token Management. Disable or replace keys that are no longer used or may have been exposed.

## Check access

```bash
curl https://infistar.ai/v1/models \
  -H "Authorization: Bearer $INFISTAR_API_KEY"
```

The default response's `data[].id` values identify callable models. A successful list request is not a test of every model capability.

## Troubleshoot authentication

| Response | What to check |
| --- | --- |
| `401` | Key is complete and active; the header includes `Bearer` followed by a space. |
| `403` | Account or permission restrictions shown by the response; inspect the specific message. |
| `402` | Available balance before sending a paid model request. |

Continue with the [API overview](/en/api-overview) or [Models API](/en/api-reference/models).