Authentication

API keys

Inference requests authenticate with an UberLLM API key. Keys start with ull_ followed by a random suffix. Pass it as a bearer token:

Authorization: Bearer ull_your_key_here

The Anthropic surface also accepts the key in the x-api-key header.

Your first key is made for you on your first visit to the dashboard and shown there with a first call you can paste. Create, edit, list, and delete keys under Dashboard → API Keys. The full secret is displayed once at creation — store it immediately; UberLLM keeps only a hash and can never show it again. Deleting a key (Dashboard → API keys → Delete) takes effect at once: apps using it stop working, and its past usage stays in your totals.

Per-key controls

Each key can carry its own guardrails, set when you create it or later with Edit on Dashboard → API keys. A change applies to the key's next request.

• Spend limit — a cap in USD over a daily, monthly, or lifetime window. Requests that would exceed it are rejected with 402 key_spend_cap_exceeded. Empty means no limit.
• Daily limit — daily_limit_usd, on top of the spend limit. A request must fit under both, and the daily limit resets at midnight UTC. A request over either limit is refused with 402 key_spend_cap_exceeded and nothing is charged. Set it on the Keys page or with PATCH /api/v1/keys/{id}.
• Rate limit — a per-minute request ceiling (1 to 10,000). Empty means the standard per-key limit (300 a minute).
• BYOK provider — pin the key to route through your own provider credential (see below).

Low-balance email

On Dashboard → Credits you can ask to be emailed when your balance falls below an amount you choose. It is off by default, sends one email each time the balance drops below that amount, and goes to the account's owners. If money set aside for an image, video, music or speech request is still held 15 minutes after the job ended, the account owners get an email listing those jobs and our team is told. That money is still yours and will be released.

BYOK — bring your own key

Add a provider credential under Dashboard → BYOK. Requests routed through a BYOK provider use your credential directly; no credits are reserved and the per-token cost is zero on your UberLLM balance. Stored credentials are encrypted and only ever surfaced as a masked last-4.

Dashboard sessions

You sign in to the web dashboard with Google (one click: the "Continue as" prompt on uberllm.dev, or the Google button), or with your email: we send a 6-digit code (and a sign-in link) that expires in 15 minutes. There is no password. Signing in mints a short-lived session, stored in an httpOnly cookie. This session is separate from your ull_ inference keys — dashboard endpoints under /api/v1/* use the cookie; the gateway (/v1/*) uses the API key.

Errors

Auth failures return an OpenAI-style error envelope:

{ "error": { "code": "invalid_api_key", "message": "…", "type": "authentication_error" } }

See Errors & limits for the full list.