Authentication

Authenticate Buble API requests with a server-side API key.

Authentication

Buble API uses API keys for server-to-server access.

Authorization: Bearer sk_your_api_key

Alternative header

X-API-Key: sk_your_api_key

Authorization: Bearer is recommended for production integrations.

API key scope

API keys are accepted only by the public API routes:

  • GET /api/v1/models
  • POST /api/v1/files
  • POST /api/v1/generations
  • GET /api/v1/generations/[id]

They are not browser sessions and should not be used with internal application routes.

Security best practices

  • Store API keys in server environment variables.
  • Never expose API keys in client-side JavaScript.
  • Use separate keys for development and production.
  • Rotate keys if they may have been leaked.