API Authentication

Two audiences: applications calling inference, and people or automation calling the management API.

API keys, for applications

API Keys → Create Key. Copy it then — it is shown once.

curl http://<host>:8001/v1/chat/completions \
  -H "Authorization: Bearer $LIFEBOAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"my-alias","messages":[{"role":"user","content":"hello"}]}'

Use a key rather than a user account: keys are scoped to inference and revocable individually, so a leaked key cannot change configuration and rotating one disturbs nothing else.

Keys also drive sticky-session affinity when that algorithm is selected — a digest of the key keeps one client on one backend so its cached prefix stays warm. The digest is what appears in the response header; the key never is.

Reveal

An administrator can retrieve a stored key when it has genuinely been lost, and the reveal is written to the audit log. That is the trade: recoverable, but never quietly. If reveals appear in the audit log that nobody expected, treat it as an incident.

Rotation

Add the new key, move clients to it, confirm traffic on the new key, then delete the old one. Nothing forces a rotation schedule; nothing prevents one either.

Management API

Authenticate as a user, with the role that covers the operation — see Users and roles. Viewer for reads, operator for server and model operations, admin for configuration, users and keys.

401 and 402

401 — missing or wrong bearer token. Check the header name and that the key was not truncated on copy.

402 license_required — the grace period has elapsed and no licence is active. This gates starting a server, not the console, so the activation page is always reachable. See Licensing.

Transport

Put TLS in front, or give Lifeboat a certificate and key. A bearer token over plaintext HTTP is a bearer token on the wire.

Sources and references

• The endpoints: OpenAI-compatible API
• Errors: API errors
• Audit: Audit log