Authentication

Every surface — HTTP, the LLM router, MCP — takes the same vaaya_sk_ key as a bearer token. Keys are created with your account, never expire on their own, and can be named and revoked at /api-keys.

The header

Authorization: Bearer vaaya_sk_...

That’s the whole story for HTTP: send the header on every request. The LLM router accepts the same key as an OpenAI-style api_key, and MCP accepts it as a bearer header for headless clients.

Getting a key

Every account has a key from signup. Sign up or log in and copy it from the keys page — create more, name them per environment, revoke any time. Give your agents credit to spend: add a card to activate your $2 welcome credit line, or buy a prepaid pack.

Key hygiene

Treat the key like money: it can spend your credit balance. Keep it in a secret store, not in client-side code.
Use one named key per deployment so a revocation is surgical.
A 401 invalid_token means the key is missing or revoked — nothing is charged.