Authentication

LLM Studio API keys look like llms_live_.... Pass yours in the Authorization header on every request:

Authorization: Bearer llms_live_xxxxxxxxxxxxxxxxx

The web app authenticates with an httpOnly session cookie. That cookie is never accepted by /v1/* -- the public API only accepts a bearer API key, even if a browser happens to send both.

Keys can be scoped at creation time. Today:

• models:read -- list and inspect available models
• inference:create -- required to call chat completions
• usage:read -- read this key's own usage summary

Revoking a key in Settings → API keys takes effect immediately -- the next request with that key returns 401 invalid_api_key.