# Authentication
Source: https://docs.mserve.ai/docs/resources/authentication
Summary: Every request carries an API key. Keys start with ms_live_ and carry their own spend and rate limits.
Availability: available
Last reviewed: 2026-08-25

## Base URLs

| SDK                     | Base URL                                                                   |
| ----------------------- | -------------------------------------------------------------------------- |
| `openai`                | `https://api.mserve.ai/openai/v1` (`https://api.mserve.ai/v1` is an alias) |
| `elevenlabs`            | `https://api.mserve.ai/elevenlabs`                                         |
| Realtime WebSocket      | `wss://api.mserve.ai/openai/v1/realtime`                                   |
| ElevenLabs stream-input | `wss://api.mserve.ai/elevenlabs/v1/text-to-speech/{voice_id}/stream-input` |

## Send the key

Two headers work everywhere. The `openai` SDK sends the first, the `elevenlabs` SDK sends the second.

```http
Authorization: Bearer ms_live_your_key
```

```http
xi-api-key: ms_live_your_key
```

WebSocket routes also accept the browser subprotocol `openai-insecure-api-key.<key>`, `xi_api_key` in the first frame (ElevenLabs stream-input), and ephemeral client secrets (Realtime).

## Keys

| Prop | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `prefix` | `string` | no |  | First 12 characters, shown in the console and in support. The full key shows once at creation. |
| `scopes` | `string[]` | no |  | Which products the key can call: voice, batch, llm. |
| `spend_limit` | `number | null` | no |  | Ceiling per period, under the account balance. A leaked key cannot drain the account. |
| `spend_limit_period` | `"daily" | "monthly" | null` | no |  | When the ceiling resets. |
| `rpm_limit` | `integer | null` | no |  | Requests per minute. Null means the default tier. |
| `concurrency_limit` | `integer | null` | no |  | In-flight requests. Null means the default tier. |
| `revoked_at` | `timestamp | null` | no |  | Set when the key is revoked. Usage history keeps the key. |

Create and revoke keys in the console.

## Inspect a key

`GET /mserve/v1/key` returns the calling key's limits, usage, and the account balance.

```bash
curl https://api.mserve.ai/mserve/v1/key -H "Authorization: Bearer $MSERVE_API_KEY"
```

```json title="Response"
{
  "label": "production",
  "prefix": "ms_live_ab12",
  "limit": 50.0,
  "limit_remaining": 41.2,
  "limit_reset": "monthly",
  "usage_daily": 0.84,
  "usage_monthly": 8.8,
  "rate_limit": { "rpm": 600, "concurrency": 20 },
  "balance": 91.2
}
```

## Errors

| Status | `code`                    | Meaning                                                       |
| ------ | ------------------------- | ------------------------------------------------------------- |
| 401    | `invalid_api_key`         | Missing, wrong, or revoked key.                               |
| 402    | `insufficient_balance`    | The account balance is zero.                                  |
| 402    | `key_spend_limit_reached` | This key hit its period ceiling. Raise it or use another key. |

```json title="401"
{ "error": { "message": "Incorrect API key provided.", "type": "invalid_request_error", "param": null, "code": "invalid_api_key" } }
```