Authentication

Keys

Every call carries Authorization: Bearer <key>. Keys start with mg_live_ or mg_test_; both are accepted everywhere and the prefix is there so you can tell at a glance which environment a leaked string belongs to. Anything that does not start with one of the two is rejected before we touch the database.

Keys are created in the dashboard or through the API below. Each one can carry its own spend cap and its own requests-per-minute limit, both enforced before anything reaches a provider.

The two scopes

A key does exactly one of two jobs, and the separation is deliberate: the credential you paste into application config is never the credential that can mint more of itself.

A provisioning key cannot create another provisioning key — every key it mints is inference. Otherwise revoking a leaked provisioning key would not be enough; you would have to go looking for whatever else it had made first.

Minting keys from the API

This is what you need if you resell Multigrid: one key per end customer, each capped, each revocable. Create a provisioning key in the dashboard first.

curl https://api.multigrid.ai/v1/keys \
  -H "Authorization: Bearer $MULTIGRID_PROVISIONING_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "customer-4192",
    "spend_limit_usd": 25,
    "rate_limit_rpm": 60
  }'

# → 201 { "id": "key_…", "key": "mg_live_…", "prefix": "mg_live_9f3a", … }
#   "key" appears here and nowhere else, ever.

GET /keys lists them, PATCH /keys/{id} changes the name, limits or enabled state, and DELETE /keys/{id} revokes one. A revoked key’s row survives, disabled: the requests it made still point at it, and deleting the row would orphan their history. An id belonging to another account reads as a 404 rather than a 403, because that is all it should tell you.

Inspecting the calling key

GET /key returns everything the gateway checks on the way in — balance, spend against the key cap, month-to-date against the account ceiling, and the rate limit. It exists so a client can tell the four ways it can be refused apart without triggering each one.

curl https://api.multigrid.ai/v1/key -H "Authorization: Bearer $MULTIGRID_API_KEY"

Authentication failures