Skip to main content
All documentation

API and Integrations

Connect an application using the documented inference API or model-training API, scoped credentials, and current usage and API references.

Workflow
  1. Choose the API productDistinguish inference requests from model-training workflows.
  2. Read its contractUse the matching API documentation and OpenAPI reference.
  3. Create a scoped keyGenerate and store a customer API key securely.
  4. Integrate and verifySend a documented request and inspect its response.
  5. Monitor and rotateReview usage and revoke or rotate keys when appropriate.

Choose the right API workflow

The inference API serves model inference requests, while the model-training API documents a separate training workflow with quotes, jobs, sessions, and artifacts. Do not assume an inference endpoint starts training or that a training operation is available through the inference contract. Read the documentation for the product you intend to use and confirm that the model or training capability is listed. Use the published request and response shapes rather than deriving method names from a familiar third-party SDK.

  1. Identify whether the application needs inference or model training.
  2. Open the matching product documentation and API reference.
  3. Confirm the requested capability and model are documented.

Create and protect an API key

Create a customer API key from the authenticated API-key page and select only the scopes your integration requires when the interface offers scope choices. The secret is shown only once, so place it directly into an approved secret manager and do not commit it to source control, paste it into logs, or expose it in browser code. Label credentials by application and environment where possible. Use separate credentials for development and production so that one can be revoked without disrupting unrelated integrations.

  1. Open API keys from the authenticated customer workspace.
  2. Create a key with the narrowest required scope.
  3. Store the secret securely and keep it out of source code and logs.

Implement against the documented contract

Follow the relevant API guide for authentication, endpoint, request fields, response handling, and errors. Keep service credentials on a trusted server rather than in public client code. Validate inputs before sending them, handle non-success responses explicitly, and avoid logging authorization headers or sensitive prompt data. Use the OpenAPI reference when you need the published machine-readable contract. Do not infer unsupported streaming, media, or provider-native operations unless the current documentation explicitly lists them.

  1. Implement only operations and fields described for the chosen API.
  2. Keep credentials server-side and redact them from diagnostics.
  3. Handle documented errors and preserve request identifiers when provided.

Monitor usage and manage credentials

After integration, review the usage page to understand the activity associated with your account and compare it with your application’s own records. Investigate unexpected changes before increasing traffic or creating additional credentials. Rotate a key if it may have been exposed, then update the application’s secret store and verify the integration before removing any remaining old credential. Revoke keys that are no longer required. Usage displays support operations review but should not be treated as a guarantee of future charges or capacity.

  1. Compare platform usage with your application’s request records.
  2. Rotate a credential that is exposed and verify the replacement.
  3. Revoke unused keys and review access periodically.

Frequently asked questions

Are inference and model training the same API?

No. They are separate products with different documented workflows. Follow the reference for the capability you need.

Where can I find the supported API contract?

Use the product documentation and OpenAPI reference linked from this guide. They describe the current published interface.

Where should I store an API secret?

Use a secure server-side secret manager. Never commit it to a repository, expose it in browser code, or include it in logs.

What should I do if a key is exposed?

Rotate or revoke it from API keys, replace it in the application’s secret store, and review recent usage for unexpected activity.

Related pages