Authentication
Every request to /v1/* is authenticated with a MarkasAI API key. Keys are created and revoked in the dashboard.
Sending the API key
| Header | Example |
|---|---|
Authorization | Authorization: Bearer mt-... |
x-api-key | x-api-key: mt-... |
Both headers are accepted on every endpoint, including /v1/messages. Use whichever your SDK or tool sends.
Key format
MarkasAI keys start with mt- followed by 43 characters (A-Z, a-z, 0-9, _, -). A key in any other format is rejected right away with 401 invalid_api_key.
Too many attempts with a wrong key from one IP address temporarily limits that IP with 429 rate_limit_exceeded.
Per-key settings
| Setting | Effect |
|---|---|
| Spend limit (Rp) | Once reached, requests are rejected with 403 key_spend_limit_exceeded. |
| Per-minute limit | Going over returns 429 rate_limit_exceeded with a Retry-After header. |
| Expiry | After this date the key is rejected with 401 invalid_api_key. |
| Allowed models | Other models are rejected with 403 model_not_allowed, and GET /v1/models only lists the allowed ones. |
Request ID
Every response carries an x-request-id header. Include it when you contact support. The same ID appears on the Requests page in the dashboard.
curl -i https://api.markas.ai.id/v1/models -H "Authorization: Bearer $MARKASAI_API_KEY"Safe practice
- Call the API from your server. Never ship the key in a browser or mobile app.
- Use one key per app or environment so you can revoke it without affecting the others.
- For third-party tools, give the key a spend limit and an allowed model list.
- Revoke a leaked key in the dashboard. Revocation takes effect immediately.