How to authenticate with the API.
Get an API Key
- Go to Settings → API Keys
- Click Create API Key
- Copy the key (starts with
inf_)
Keys can be scoped to least privilege — for example apps:execute without secrets:write. See API Keys API for the scope catalog (GET /scopes), preset bundles, and programmatic create/list/revoke.
Keep it Secret
- Don't commit to git
- Don't share publicly
- Use environment variables
1export INFERENCE_API_KEY="inf_your_key"Browser apps? Never expose API keys in client-side code. Use a Server Proxy to keep credentials safe.
Using the Key
With SDKs
1from inferencesh import inference2import os34# Direct5client = inference(api_key="inf_your_key")67# From environment variable8client = inference(api_key=os.environ["INFERENCE_API_KEY"])With REST API
1curl https://api.inference.sh/apps/run \2 -H "Authorization: Bearer inf_your_key" \3 -H "Content-Type: application/json" \4 -H "X-API-Version: 2" \5 -d '{"app": "infsh/echo", "input": {"message": "Hello!"}}'Official SDKs and the belt/infsh CLIs send X-API-Version: 2 automatically. See REST API version for response and error formats.
Team context
Most API resources are scoped to a team. Which team a request uses depends on how the API key was created:
| Key source | Team context |
|---|---|
| Settings → API Keys (manually created) | Fixed to the team selected when the key was created. These are team-pinned machine credentials for CI, engines, and automation. |
Device authorization (belt login, CLI) | Acts as you — can switch teams with X-Team-ID or belt auth switch. |
To act as another team you belong to with a device-auth key, send its team ID:
1curl https://api.inference.sh/apps/my \2 -H "Authorization: Bearer inf_your_key" \3 -H "X-Team-ID: team_abc123"You must be a member of that team. If the header names a team you cannot access, it is ignored and the key's current team is used.
Manually created keys ignore X-Team-ID. A leaked CI or automation key cannot be pointed at your other teams via a header. Create separate keys per team, or use device authorization for interactive tooling that needs team switching.
In the CLI, use belt auth switch instead of setting the header manually.
Sign-in APIs
API keys are for programmatic access. To sign users into the workspace (browser session) or CLI, use the dedicated auth endpoints:
| Flow | Use case | Guide |
|---|---|---|
| Magic link + login code | Email passwordless sign-in for the web app | Magic link API |
| Device authorization | CLI, IDE, and headless login (belt login) | Device authorization API |
| Standard OAuth device grant | Off-the-shelf OAuth 2.0 client libraries | Device authorization — RFC endpoints |
Magic link sign-in returns a session cookie. Device authorization returns a session token (recommended; token_kind: "session") or a legacy API key on the first successful poll after browser approval (one-shot delivery). Session tokens are sent as Authorization: Bearer … and behave like web sessions — including X-Team-ID team switching and revocation from Settings → Sessions or via POST /oauth/revoke (RFC 7009).
Install SDKs
1pip install inferencesh23# With async support4pip install inferencesh[async]Next
→ SDK Overview — Running apps, streaming, files → Server Proxy — Protect API keys in browser apps