> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trymorse.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Send your key as a Bearer token, keep it on your server, and limit what each key can spend, where it can call from, and which models it can use.

Send your key in the `Authorization` header of every request:

```http theme={null}
Authorization: Bearer sk_morse_...
```

Every key starts with `sk_morse_` and ends with a short checksum, so a secret scanner can recognize a leaked key. A request gets `401` with the code `invalid_api_key` when its key is missing, unknown, or revoked. A token that starts with `sk_` but isn't a whole Morse key gets the same answer.

## Keep your key on a server

Anyone with your key can spend your credits, so treat it as a password. Morse stores only a hash of the key and shows the key once, when you create it.

Call the API from your own server. Don't put a key in code that ships to a browser or a mobile app, because anyone who loads the page or the app can read it.

## Manage your keys

Create and revoke keys in the **Keys** tab of the [API page](https://trymorse.ai/api?tab=keys) in the Morse app. An account can have up to 25 active keys, and it can create up to 50 keys a day, revoked ones included.

Each key shows when it last paid for a request. The time updates at most once a minute. A request that Morse refuses before it bills anything doesn't count, and neither does `GET /v1/models`, which is free.

A revoked key stops working at once, and you can't undo a revoke.

## Limit a key

A key can have any of these limits. Set them when you create the key, or change them later. An expired or revoked key can't change.

| Limit | What it does | A refused request gets |
| - | - | - |
| Spend limit | Caps the credits the key spends. The limit resets daily, weekly, monthly, or never. | `402` with `key_spend_limit_reached` |
| Expiry | Stops the key at a time you choose. | `401` with `api_key_expired` |
| Allowed IPs | Admits requests only from up to 100 IPv4 or IPv6 addresses or CIDR ranges. | `403` with `ip_not_allowed` |
| Lowest privacy tier | Admits only models at this [tier](https://docs.trymorse.ai/models.md#what-each-tier-protects) or above, in the order `anon`, `private`, `tee`, `e2ee`. A new key starts at `private`. | `403` with `model_tier_not_allowed` |

A spend limit's day, week, and month start at 00:00 UTC. A week starts on Monday, and a month on the 1st. When a limit that resets refuses a request, the reply's `Retry-After` header holds the seconds until the reset.

A chat holds its most possible cost against the key's spend limit, the same way it holds against your balance. If the rest of the limit can't cover the hold, Morse lowers the output limit, and the reply carries the header `X-Output-Limited: key_limit`. See [Billing](https://docs.trymorse.ai/billing.md#holds-and-402).

`GET /v1/models` lists only the models that a key's lowest tier admits.

## What a key can't do

A key calls the endpoints in the API reference: chat completions, image generation, transcription, web search, page fetch, and the model list. It can't manage your account. The endpoints for your balance, usage, keys, and purchases answer a key with `401` and the code `login_required`. Check your balance in the Morse app.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.