Authentication and API keys

Authorization header

Send your Netra API key in the HTTP header:

Authorization: Bearer <NETRA_API_KEY>

Use a Netra key, not an OpenAI key or a dashboard sign-in token. Keys belong to the organization selected when they are created. Switching the organization in the dashboard does not change an existing key's organization.

The full secret is returned once at creation. API Keys subsequently shows identifying details, last recorded use, status, expiry, and configured limits. Long key names wrap so the full name remains readable. If you lose the secret, create a replacement and revoke the old key after updating your applications. If a key is exposed, revoke it and replace it.

Last used shows the most recent recorded inference request for that key. Updates can be delayed; MCP reads, trace exports and requests without recorded inference usage do not update it. Older activity may be unavailable. No recorded use does not prove that the key has never been used.

Consumed (USD) shows lifetime recorded spend for each inference API key, including revoked keys. It refreshes as new usage is recorded.

Keys can have expiration, requests-per-minute limits, tokens-per-minute limits, and a monthly spending budget. Organization limits also apply. These are spending and traffic controls. Workload API keys have no customer management permissions.

Keep keys in server-side secret storage. Do not include them in browser bundles, source control, screenshots, copied context, telemetry attributes, or model prompts. Configure an agent's connection secret through its credential settings rather than writing it in the chat.

The observation MCP uses the same API-key credentials as inference. Its tools are read-only, but the credential itself can also authorize inference. Activity tools are limited to the organization and key that authenticate the connection. A new key with no traffic will not see another key's requests. The netra_get_balance tool reads the shared wallet of the key's owning organization, including for a new key with no activity. There is no organization override.

For customer management tools, create a separate MCP connection in API Keys. Choose an expiry and explicit permissions for the selected workspace. The connection token is shown once, can be revoked, and cannot authorize inference. Current membership and role are checked on each MCP call; a workload key's creator does not grant management privileges to that key. See the MCP guide for available customer tools and permissions.

GET /v1/models without authorization lists the public base-model catalog. Authenticate to include the organization's models. Supplying an invalid header returns an authentication error rather than silently falling back to the public catalog.