Authentication

JouleCloud uses bearer-token authentication, exactly like the OpenAI API. Keys are scoped to your organization.

The organization key

Every organization has one gateway API key. It is minted on demand the first time your org needs it and stored server-side; it is shared by the members of that org. Reveal or copy it from the console settings.

Using the key

Send it as a bearer token on every request:

Authorization: Bearer <your-org-key>

With the OpenAI SDKs, pass it as the api_key / apiKey and set the base URL to https://api.jouledns.com/v1.

Rotation

Rotating mints a fresh key and revokes the old one immediately. Any client still using the previous key starts receiving 401 responses, so roll it out to your services before rotating. Rotate from the console.

One key per org today. Multiple named, individually scoped keys are not yet available — every member of an org shares the same key. Named keys are on the roadmap.

Keeping keys safe

Store keys in environment variables or a secrets manager, never in committed source.
The key authorizes spend against your org budget — treat it like a password.
If a key leaks, rotate it from the console; the old key stops working at once.