Authentication

Authenticate Krun API requests with a bearer API key from your server. Never expose a key in client-side code.

The Krun API uses API keys. Send your key in the Authorization header of every /v1 request:

Authorization: Bearer krun_live_...

curl

curl https://api.krun.ai/v1/models \
  -H "Authorization: Bearer $KRUN_API_KEY"

Getting a key

Krun is in closed beta. API keys are issued per project: request access. Keys start with krun_live_.

Every key of a project shares the project’s quotas and can send feedback for the project’s decisions. Rate limits apply per key. See Rate limits and quotas.

Keep keys on the server

Never expose a Krun API key in browser or client-side code. Anyone who can read the key can make requests with it and use your quota.

Krun is a server-to-server API:

• Call it from your backend, a serverless function or a worker, never from a web page, mobile app or desktop app.
• There is no browser SDK, and the API does not send CORS headers.
• Store the key in an environment variable (KRUN_API_KEY) or a secret manager. Don’t commit it to source control.
• Use a separate key per service or environment, so you can revoke one without affecting the others.

If a key is exposed, contact support to revoke it and get a new one.

Authentication errors

A missing, malformed, unknown or revoked key returns 401:

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "missing, invalid or revoked API key",
    "request_id": "req_9475ca2887b4400a9ae9bec5563746ac"
  }
}

The Python SDK raises krun.AuthenticationError. Don’t retry it: fix the key first.