Authentication

The Cheaper Gen. API uses secret API keys. Send your key as a bearer token in the Authorization header of every request to an authenticated endpoint:

Authorization: Bearer cg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Creating a key#

Open Dashboard → API keys and click Create key. Give it a name that says where it is used (for example production-backend). Keys have the format cg_live_ followed by 32 random characters.

The full key is shown once. We only store a SHA-256 hash of it, so we can't show it again — if you lose a key, revoke it and create a new one. The dashboard lists each key by its prefix, creation date and when it was last used.

Making an authenticated request#

curl https://cheapergen.com/api/v1/account \
  -H "Authorization: Bearer $CHEAPERGEN_API_KEY"

import os, requests

resp = requests.get(
    "https://cheapergen.com/api/v1/account",
    headers={"Authorization": f"Bearer {os.environ['CHEAPERGEN_API_KEY']}"},
)
print(resp.json())

const resp = await fetch("https://cheapergen.com/api/v1/account", {
  headers: { Authorization: `Bearer ${process.env.CHEAPERGEN_API_KEY}` },
});
console.log(await resp.json());

Public endpoints#

Catalog and pricing endpoints don't need a key, so you can call them from a browser or a build step: GET /api/v1/models, GET /api/v1/models/{vendor}/{model} and POST /api/v1/quote/{endpoint}. Everything else — submitting, reading and canceling generations, uploads and your account — requires a key. See the API reference for the full list.

Keeping keys safe#

• Server-side only. Never ship a key in a mobile app, browser bundle or public repository. Anyone with the key can spend your balance.
• Use environment variables or a secrets manager — not source code. Examples in these docs read CHEAPERGEN_API_KEY.
• One key per environment or service, so you can revoke one without touching the others.
• Rotate by creating a new key, deploying it, then revoking the old one. Revocation takes effect immediately.

Building a client-side app?#

Proxy requests through your own backend: your server holds the key, authenticates your users and forwards the generation request. Use webhooks to learn when a job finishes and push the result to your users.

Authentication errors#

A missing, malformed or revoked key returns 401 unauthorized:

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or revoked API key"
  }
}

Requests made from our own website (the Studio and the playground on model pages) are authenticated with your signed-in session instead of a key; they show up in your dashboard with the source playground.