Authentication

Every API request must include a bearer token issued from the console. Keys always start with vela-.

Authorization: Bearer vela-...

Key hygiene

• Create one key per application or environment.
• The full secret is shown only at creation time.
• Revoke a key immediately if it leaks. Usage stops on the next request.
• Never ship a key in a browser bundle. Call Vela from your server.

Errors

Missing or unknown keys return 401. Exhausted credits return 402. Unknown models return 400.