Authentication & API keys

Bearer authentication

Every API request authenticates with an API key in the Authorization header. There is no cookie or query-string auth on the API surface.

curl https://router-api.intelli-verse-x.ai/v1/chat/completions \
  -H "Authorization: Bearer $INTELLIVERSE_API_KEY" \
  -d '{ "messages": [{"role":"user","content":"..."}] }'

Key types

• API keys (iv-r-v1-…) — authenticate data-plane requests: chat, media, knowledge base, credits. Each key is bound to an app_id and carries its plan tier's rate limit. Optionally set a monthly spend cap per key.
• Management keys (ivm-…) — control-plane credentials for isolated, server-side provisioning automation only: provision apps, mint API keys, and configure guardrails or presets. Create them under Dashboard → Management Keys. Never put one in an end-user Agent, desktop app, Shortcut, or mixed-capability MCP client.

Creating and rotating keys

Mint keys under Dashboard → Keys: pick the app_id it should bill against, optionally set a spend cap, and copy the one-time reveal. Rotation is create-new → deploy → revoke-old; revocation takes effect at the edge within seconds.

Sharing with teammates

Three patterns — pick the least privilege that fits:

• API key handoff — mint a key bound to the right app_id with a spend cap, and share the reveal through your password manager. Teammates only need the quickstart baseURL + Bearer token.
• Preset export — save a preset, click Export under Dashboard → Presets, and paste the JSON into another workspace or a repo. Reference it as @preset/your-slug in requests — see Presets & plugins.
• Management key (isolated provisioning CI only) — use a dedicated server-side job for provisioning keys, guardrails, and presets. Scope it tightly, require protected CI approvals, rotate on leak, never commit it, and never expose it to an Agent or client configuration.