Authentication

API Keys

All requests to ModelStack require authentication via an API key. Keys are passed in the Authorization header using the Bearer token format.

Header Format

Authorization: Bearer [your_api_key]

Key Format

ModelStack API keys follow this format:

sk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

All keys are prefixed with sk_ followed by a random alphanumeric string.

Getting an API Key

Sign in to your dashboard
Navigate to API Keys
Click Create API Key
Give your key a descriptive name
Copy the key immediately — it won’t be shown again

Treat your API key like a password. Do not expose it in client-side code, public repositories, or logs. If a key is compromised, revoke it immediately from your dashboard.

Example Request

curl https://api.modelstack.cc/v1/chat/completions \
  -H "Authorization: Bearer [your_api_key]" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "claude-sonnet-4-5",
    "messages": [{"role": "user", "content": "Hello!"}]
  }'

from openai import OpenAI

client = OpenAI(
    api_key="your_api_key",
    base_url="https://api.modelstack.cc/v1"
)

import OpenAI from "openai";

const client = new OpenAI({
  apiKey: "your_api_key",
  baseURL: "https://api.modelstack.cc/v1",
});

API Key Limits

The number of API keys you can create depends on your plan:

Plan	Max API Keys
Starter	5
Pro	20
Max	Unlimited

Security Best Practices

Use environment variables

Store your API key in environment variables rather than hardcoding it:

export MODELSTACK_API_KEY="your_api_key"

import os
api_key = os.environ["MODELSTACK_API_KEY"]

Use separate keys for different environments

Create distinct API keys for development, staging, and production. This lets you revoke a compromised key without affecting other environments.

Rotate keys periodically

Rotate your API keys regularly. Create a new key, update your applications, then revoke the old key.

Never commit keys to source control

Add .env files to .gitignore and use secret management tools for production deployments.

Error Responses

If authentication fails, the API returns a 401 Unauthorized error:

{
  "error": {
    "message": "Invalid API key provided",
    "type": "authentication_error",
    "code": 401
  }
}

Overview

Endpoints

API Keys

Header Format

Key Format

Getting an API Key

Example Request

API Key Limits

Security Best Practices

Error Responses

​API Keys

​Header Format

​Key Format

​Getting an API Key

​Example Request

​API Key Limits

​Security Best Practices

​Error Responses

API Keys

Header Format

Key Format

Getting an API Key

Example Request

API Key Limits

Security Best Practices

Error Responses