Authorization header of every request:
sk_morse_ and ends with a short checksum, so a secret scanner can recognize a leaked key. A request with no key, a key Morse doesn’t know, a revoked key, or a token that starts with sk_ but isn’t a whole Morse key gets 401 with the code invalid_api_key.
Keep your key on a server
Anyone with your key can spend your credits, so treat it as a password. Morse stores only a hash of the key and shows the key once, when you create it. Call the API from your own server. The API sends cross-origin (CORS) headers only to the Morse app, so a browser blocks calls from a page on another site. Don’t put a key in code that ships to a browser or a mobile app.Manage your keys
Manage keys in the Morse app, under Settings > API keys. An account can have up to 25 active keys. Each key shows when it last paid for a request. A request that Morse refuses before it bills anything doesn’t count, whether for its body, its model, your balance, or a rate limit.GET /v1/models doesn’t count either, because it’s free. The time updates at most once a minute.
To revoke a key, click Revoke next to it, then Revoke key. Morse refuses the key’s requests from then on. You can’t undo a revoke.
What a key can’t do
A key calls the endpoints in the API reference: chat completions, image generation, web search, page fetch, and the model list. It can’t manage your account. The endpoints for your balance, usage, keys, and purchases answer a key with401 and the code login_required. Check your balance in the Morse app.