Authentication

Every request carries your API key as a bearer token:

Authorization: Bearer ib_live_...

• Keys are created and revoked in the dashboard. The plaintext is shown once at creation; we store only a hash.
• Keys are account-scoped. Each key carries the budget and rate limits of your plan, enforced at the gateway.
• A revoked key fails immediately with 401 {"error": {"type": "authentication_error", ...}}.
• Never ship a key in client-side code. For browser apps, proxy through your backend.

Budgets

Your remaining credit balance is pushed to the gateway as a hard budget on each of your keys. When it reaches zero, requests fail with 402. Usage may take a few minutes to reflect in the dashboard; enforcement at the gateway is continuous.