Skip to main content
Aria Compute API keys are Bifrost virtual keys prefixed with bfvk-. You create them from the dashboard, use them against the per-site gateway and model download endpoints, and rotate them by creating a new key and deleting the old one.

​
When to use an API key

Use an API key for server-to-server calls that hit the gateway or the model download endpoints. Use a session JWT for user-scoped actions in the dashboard API (billing, account settings, session management).

​
Create, list, revoke

Three endpoints manage keys, all under a session Bearer:
  • GET /api/api-keys returns your keys with prefix, name, created_at, last_used_at. The full key is never returned again.
  • POST /api/api-keys accepts { "name": "..." } and returns the full key exactly once.
  • DELETE /api/api-keys/{id} revokes a key immediately. Subsequent calls with that key return 401 from the gateway and download endpoints.
See the Manage API keys guide for a step-by-step walkthrough.

​
Per-site scoping

Keys are scoped to the site that issued them. A key created on ariacompute.com targets gateway.ariacompute.com and cannot authenticate against gateway.ariacompute.cn. If you use both sites, maintain a separate key per region.

​
Rotation

Rotate keys on a schedule that fits your compliance needs:
  1. Create the new key.
  2. Deploy it alongside the old key.
  3. Confirm traffic uses the new key.
  4. DELETE the old key.
Never commit bfvk- keys to source control or paste them into client-side JavaScript. Anyone who has the key can drain your wallet.