> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ariacompute.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys for gateway and model access

> Bifrost bfvk keys authenticate calls to the per-site gateway and authenticated model downloads. Learn how they scope, rotate, and differ from session JWTs.

Aria Compute API keys are Bifrost virtual keys prefixed with `bfvk-`. You create them from the dashboard, use them against the per-site gateway and model download endpoints, and rotate them by creating a new key and deleting the old one.

## When to use an API key

Use an API key for server-to-server calls that hit the gateway or the model download endpoints. Use a session JWT for user-scoped actions in the dashboard API (billing, account settings, session management).

|           | Session JWT                                      | API key (`bfvk-`)                      |
| --------- | ------------------------------------------------ | -------------------------------------- |
| Prefix    | `eyJhbGciOi...`                                  | `bfvk-...`                             |
| Lifetime  | Short-lived, renewed on login                    | Long-lived until revoked               |
| Scope     | The signed-in user                               | The account that created the key       |
| Sent as   | `Authorization: Bearer` (or `?token=`)           | `Authorization: Bearer`                |
| Endpoints | `/api/auth/*`, `/api/billing/*`, `/api/api-keys` | Gateway, `/api/models/{slug}/download` |

## Create, list, revoke

Three endpoints manage keys, all under a session Bearer:

* `GET /api/api-keys` returns your keys with `prefix`, `name`, `created_at`, `last_used_at`. The full key is never returned again.
* `POST /api/api-keys` accepts `{ "name": "..." }` and returns the full `key` exactly once.
* `DELETE /api/api-keys/{id}` revokes a key immediately. Subsequent calls with that key return `401` from the gateway and download endpoints.

See the [Manage API keys guide](/guides/manage-api-keys) for a step-by-step walkthrough.

## Per-site scoping

Keys are scoped to the site that issued them. A key created on `ariacompute.com` targets `gateway.ariacompute.com` and cannot authenticate against `gateway.ariacompute.cn`. If you use both sites, maintain a separate key per region.

## Rotation

Rotate keys on a schedule that fits your compliance needs:

1. Create the new key.
2. Deploy it alongside the old key.
3. Confirm traffic uses the new key.
4. `DELETE` the old key.

<Warning>
  Never commit `bfvk-` keys to source control or paste them into client-side JavaScript. Anyone who has the key can drain your wallet.
</Warning>

## Related

* [Authentication overview](/authentication)
* [Manage API keys](/guides/manage-api-keys)
* [POST /api/api-keys](/api-reference/api-keys/create)


## Related topics

- [DELETE /api/api-keys/{id} — revoke an API key](/api-reference/api-keys/delete.md)
- [Create, rotate, and revoke your API keys](/guides/manage-api-keys.md)
- [API authentication: session tokens and API keys](/api-reference/authentication.md)
- [Authenticate requests to the Aria Compute API](/authentication.md)
- [Aria Compute REST API reference](/api-reference/introduction.md)