Authentication

All Assisters API requests require authentication using an API key. This guide covers how to create, use, and manage your API keys securely.

API Keys

API keys are the primary method for authenticating with Assisters API. Each key:

• Starts with the prefix ask_
• Is tied to your account for billing
• Can be restricted to specific domains (optional)
• Can be revoked at any time

Creating an API Key

Using Your API Key

Include your API key in the Authorization header with the Bearer prefix:

from openai import OpenAI

client = OpenAI(
    api_key="ask_your_api_key_here",
    base_url="https://api.assisters.dev/v1"
)

import OpenAI from 'openai';

const client = new OpenAI({
  apiKey: 'ask_your_api_key_here',
  baseURL: 'https://api.assisters.dev/v1'
});

curl https://api.assisters.dev/v1/chat/completions \
  -H "Authorization: Bearer ask_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"model": "assisters-chat-v1", "messages": [...]}'

API Key Limits

Each account can have up to 10 active API keys. The first key created is automatically marked as the primary key.

Domain Restrictions

You can restrict API keys to specific domains for additional security. This is useful for client-side applications where the key might be exposed.

{
  "allowed_domains": [
    "example.com",
    "app.example.com",
    "*.example.com"
  ]
}

Security Best Practices

Environment Variables

Store your API key in environment variables:

export ASSISTERS_API_KEY="ask_your_api_key_here"

$env:ASSISTERS_API_KEY="ask_your_api_key_here"

ASSISTERS_API_KEY=ask_your_api_key_here

Then access it in your code:

import os
from openai import OpenAI

client = OpenAI(
    api_key=os.environ["ASSISTERS_API_KEY"],
    base_url="https://api.assisters.dev/v1"
)

const client = new OpenAI({
  apiKey: process.env.ASSISTERS_API_KEY,
  baseURL: 'https://api.assisters.dev/v1'
});

Git Ignore

Always add your .env file to .gitignore:

# .gitignore
.env
.env.local
.env.*.local

Managing API Keys

View All Keys

In your dashboard, you can see all your API keys with:

• Name and creation date
• Key prefix (first 12 characters)
• Primary key status
• Domain restrictions
• Last used timestamp

Revoke a Key

To revoke a key:

1. Go to your API Keys dashboard
2. Find the key you want to revoke
3. Click the Revoke button
4. Confirm the revocation

Set Primary Key

The primary key is used for embed widgets. To change your primary key:

1. Go to your API Keys dashboard
2. Find the key you want to make primary
3. Click Set as Primary

Rate Limits

Your API key has a default rate limit of 60 requests per minute. See the rate limits guide for handling 429 errors.

Error Responses

401 Unauthorized

{
  "error": {
    "message": "Invalid API key provided",
    "type": "invalid_request_error",
    "code": "invalid_api_key"
  }
}

Causes:

• API key is missing or malformed
• API key has been revoked
• API key doesn't start with ask_

403 Forbidden

{
  "error": {
    "message": "Request origin not allowed for this API key",
    "type": "invalid_request_error",
    "code": "origin_not_allowed"
  }
}

Causes:

• Request came from a domain not in the allowed list
• Domain restrictions are blocking the request

Next Steps