Authentication

Create an API key in Indream's developer settings. The key belongs to a workspace. Requests use that workspace's resources, credits, and subscription limits.

Send the key

Include your generated API key in the Authorization header:

curl --fail-with-body https://api.indream.ai/v1/projects \
  -H 'Authorization: Bearer <YOUR_API_KEY>'

Use the full key, including its sk_indream_ prefix. The HTTP API accepts generated API keys; an OAuth access token is not a substitute.

Both SDKs set the header when you pass apiKey in JavaScript or api_key in Python. The OpenClaw plugin accepts the same key in its plugin configuration.

Keep keys on your server

Store keys in your server's secret manager. Do not embed a key in browser code, a mobile application, a public repository, or a shared example. If your interface runs in a browser, send requests through your own backend.

For interactive requests in the API reference, enter the key yourself. The documentation proxy forwards it to the API for the request. Clear the playground credentials when using a shared computer.

Replace a key

Create a replacement key, update your server, and verify a request with it. Revoke the previous key after your integration uses the replacement. Revoke an exposed key immediately.

A replacement key must belong to the workspace whose resources you want to access.

Resolve authentication errors

• 401: Check that the header contains a valid, active API key. Remove accidental whitespace and replace a revoked key.
• 403: Check the requested action and workspace access. A valid key does not grant access to every resource.
• 404: Confirm the resource ID and that the key belongs to its workspace.

Read the returned errorCode before deciding what to do. Errors and retries distinguishes authentication errors from usage limits and request throttling.