Skip to main content
Varo Cloud uses API key authentication to secure all requests to the API. Every call you make to https://inference.varo.cloud/v1 must include a valid API key in the Authorization header using the Bearer token scheme. Without a properly formatted key, requests are rejected before they reach any endpoint.

​
Generate an API key

To generate a new key:
  1. Sign in at varo.cloud/auth and open the dashboard.
  2. Navigate to API Keys in the navigation bar.
  3. Click Create Key.
  4. Enter a descriptive name for the key (for example, Production or ci-pipeline).
  5. Click Create and immediately copy the key that appears.
Your key is shown only once. Store it in a secrets manager such as AWS Secrets Manager, HashiCorp Vault, or your CI/CD platform’s encrypted environment variables. There is no way to retrieve the key value after you close the dialog.

​
Using your API key

API keys start with the sk_live_ prefix. Pass your key in the Authorization header of every request. The header value must follow the format Bearer YOUR_API_KEY.
Reading the key from an environment variable (as shown in the JavaScript example) is strongly recommended. Avoid hardcoding key values directly in source code or committing them to version control.
Every model’s detail page has an API tab with ready-to-run HTTP, Python, and JavaScript examples that stay in sync with your Playground inputs — a fast way to grab working code for the exact model and parameters you want.

​
Manage your keys

The API Keys page lists every key in your account along with its name, creation date, status, usage (calls and spend), and when it was last used. Because keys carry full access to your account, the best practice is to create a dedicated key for each application or integration rather than sharing a single key:
  • Create one key per application or pipeline (for example, separate keys for staging and production).
  • Create separate keys for third-party integrations so you can cut off a single integration without affecting others.
  • Name each key clearly so you can identify its purpose at a glance in the API Keys list.

​
Delete a key

If a key is compromised or no longer needed, delete it from the API Keys page. Click the delete action next to the key and confirm.
Deleting a key immediately invalidates it and cannot be undone. Update your applications with a new key before deleting the old one to avoid service interruptions caused by failed authentication.

​
Authentication errors

When a request fails due to an authentication or authorization issue, the API returns a JSON error body alongside an HTTP status code. The table below describes the most common authentication-related errors.