Authentication

The Mindrift API uses API keys to authenticate requests. You can create and manage your keys in the Mindrift dashboard.

Your API keys carry full access to your account’s enabled services and billing balance. Keep them secret and never share them in publicly accessible areas, client-side code or version control repositories.

Creating an API Key

To start making requests to the Mindrift API, you must generate an API key from your dashboard:

1. Sign in to your account at platform.mindrift.art.
2. Go to API Keys in the navigation menu.
3. Click Create new key.
4. Fill in the key configuration:
   1. Key Name: A descriptive label to identify where the key is used (e.g. Production Backend, Staging Worker).
   2. Service Permissions: Select the capabilities granted to this key: Text & Chat, Image, Video, or Audio & Voice. Requests targeting services not enabled for the key are rejected with a 403 Forbidden error.
   3. Allowed IP Addresses (optional): Restrict requests to specific IPv4/IPv6 addresses or CIDR blocks (e.g. 192.168.1.50, 10.0.0.0/24). Requests from any other IP address are blocked.
   4. Monthly Budget (optional) : Set a spending cap in USD for this specific key. The spend counter automatically resets on the 1st of every month at 00:00 Europe/Paris time.
   5. Expiration (optional): Set an automatic expiration window (30 days, 90 days, or 1 year), or choose never to expire.
   6. Copy and store your secret key immediately. For security reasons, the full key secret is only displayed once and cannot be retrieved later.

All live secret keys are prefixed with sk_to make them easy to recognize and scan in secret detection tools.

How Bearer Authentication Works

Every request to the Mindrift API must authenticate using standard HTTP Bearer token authentication.

The Authorization Header

Instead of passing credentials through URLs, cookies or body parameters, your API key must be transmitted in the HTTP request headers using the standard Authorization header field.

The header value consists of two parts separated by a single space:

• The scheme identifier: the exact word Bearer
• Your actual secret API key

Authorization: Bearer sk_xxxxxxxxxxxxxxxxxxxxxxxxxxxx

Transport Security (HTTPS Required)

Because Bearer authentication tokens act as secret bearer credentials (meaning anyone who possesses the token is granted access), all API traffic must be encrypted in transit.

• The Mindrift API is served strictly over HTTPS at https://api.mindrift.art.
• Requests sent over unencrypted plain HTTP (http://) are rejected or redirected to HTTPS.
• Never disable SSL/TLS verification in your HTTP client library when communicating with the API.

Request Identification

Every API response includes an x-request-id header containing a unique UUID. Whenever you encounter unexpected authentication failures or need support, include this request ID in your inquiry to help our team trace the exact request in our access logs.

Authentication Errors

Authentication errors follow our standard JSON error structure:

{
  "error": {
    "type": "authentication_error",
    "code": "INVALID_API_KEY",
    "message": "Invalid or inactive API key provided.",
    "request_id": "7b8f9e21-4d1a-4638-9b88-51e8201bfb7c"
  }
}