Two credentials, and only one of them is refused anywhere.
A session bearer token, the same one the apps hold, is accepted on every operation. An AGI API key (sk_live_…, issued in the developer console) carries the scopes you pick when you create it and reaches everything except embeddings: models:read for the catalog, inference:write for chat completions, audio transcriptions and route preview, usage:read for the credit balance. Every operation in the bundle names the credential and the scope it accepts. API key access is included with Pro, Max 5x, Max 20x, Team, and Enterprise; on any other plan the gateway refuses the key with managed_api_plan_required.
- Stream tokens back with stream: true
- model: "auto" routes per request; name a model to pin it
- BYOK on CLI and VS Code never touches this gateway
Authorization: Bearer <session token> GET /api/llm/v1/modelsPOST /api/llm/v1/chat/completionsPOST /api/llm/v1/embeddingsPOST /api/llm/v1/audio/transcriptionsPOST /api/llm/v1/route/previewGET /api/llm/v1/credits/balance