Authentication - Yelu AI API

Yelu authenticates OpenAI-compatible API requests with an API key in the HTTP Authorization header.

Bearer authentication

Include the key on every request:

Authorization: Bearer $YELU_API_KEY

curl https://api.yelu.ai/v1/models \
  -H "Authorization: Bearer $YELU_API_KEY"

const response = await fetch('https://api.yelu.ai/v1/models', {
  headers: { Authorization: `Bearer ${process.env.YELU_API_KEY}` },
});

if (!response.ok) throw new Error(`Authentication failed: ${response.status}`);
console.log(await response.json());

import os
import requests

response = requests.get(
    "https://api.yelu.ai/v1/models",
    headers={"Authorization": f"Bearer {os.environ['YELU_API_KEY']}"},
    timeout=30,
)
response.raise_for_status()
print(response.json())

Key lifecycle

Create separate keys

Use a distinct key for each application and environment. Separation makes rotation, attribution, limits, and incident response safer.

Store keys as secrets

Keep keys in a secret manager or protected environment variable. Restrict who and which workloads can read them.

Rotate regularly

Create a replacement, deploy it, verify traffic, then revoke the old key. Do not wait for a suspected leak.

Revoke on exposure

If a key appears in a repository, log, screenshot, or browser bundle, revoke it immediately. Removing the visible copy is not sufficient.

Server-side only

Never call Yelu directly from untrusted browser or mobile code with a long-lived API key. Put authentication and authorization in your own backend, then have that backend call Yelu.

For a browser-facing product, your server should:

authenticate the end user;
authorize the requested feature and model;
enforce per-user budgets and abuse controls;
keep the Yelu key server-side;
validate input and limit output size;
avoid logging prompts or generated content unless required and disclosed.

Authentication failures

Status	Meaning	Action
`401`	The key is missing, malformed, unknown, expired, or disabled.	Check the header and rotate the key if necessary.
`403`	The account, key, IP, group, or requested resource is not permitted.	Check key restrictions and model access in the dashboard.
`429`	The authenticated account or group has reached a request limit.	Back off and retry according to Rate limits.

Errors use an OpenAI-compatible error object. See Errors for parsing and retry guidance.

OpenAI SDK environment

You can use SDK-native environment variables or pass values explicitly. Explicit configuration is clearest when an application uses multiple AI gateways.

export YELU_API_KEY="your_api_key"
curl https://api.yelu.ai/v1/models -H "Authorization: Bearer $YELU_API_KEY"

import OpenAI from 'openai';

const client = new OpenAI({
  apiKey: process.env.YELU_API_KEY,
  baseURL: 'https://api.yelu.ai/v1',
});

import os
from openai import OpenAI

client = OpenAI(
    api_key=os.environ["YELU_API_KEY"],
    base_url="https://api.yelu.ai/v1",
)

​Bearer authentication

​Key lifecycle

​Server-side only

​Authentication failures

​OpenAI SDK environment

Bearer authentication

Key lifecycle

Server-side only

Authentication failures

OpenAI SDK environment