Authentication
How to authenticate your requests to the Altirs API using API keys.
API Keys
All requests to the Altirs API must be authenticated with an API key. Keys are created from your dashboard and follow the format grd_....
Sending Your Key
You can provide your API key using either method:
X-Api-Key Header (Recommended)
curl -H "X-Api-Key: grd_your_key_here" \
https://altirs.ai/api/v1/guardrail/checkAuthorization Bearer
curl -H "Authorization: Bearer grd_your_key_here" \
https://altirs.ai/api/v1/guardrail/checkKey Scoping
API keys can be restricted to specific check types. A key scoped to ["pii"] can only run PII detection. Requests for other checks return 403 Forbidden.
When creating a key in the dashboard, select which checks the key is authorized to run. Leaving all unchecked allows access to all checks.
If a scoped key makes a request without specifying checks, the API automatically restricts to the key's allowed checks.
Key Security
- API keys are hashed with bcrypt before storage, so plaintext keys are never stored
- The full key is shown only once at creation time
- A key preview (first/last few characters) is displayed in the dashboard for identification
- Keys can be revoked (deactivated) or deleted at any time
- All key operations are recorded in the audit log
Error Responses
| Status | Error | Cause |
|---|---|---|
401 | Missing API key | No X-Api-Key or Authorization header |
401 | Invalid API key format | Key doesn't start with grd_ |
401 | Invalid API key | Key not found or failed hash verification |
403 | Not authorized for checks | Scoped key tried to use a disallowed check |