Keys and authentication

Every request except GET /models needs a key in the header:

Authorization: Bearer mxn-...

Issuing a key

Account → Profile → API keys → “Create key”.

The full key is shown once, right after creation. We store only a sha256 hash, the prefix and the last few characters — a key cannot be recovered, so replace a lost one rather than hunting for it.

Scopes

A key can be limited to a set of capabilities. There are seven:

Scope	What it unlocks
chat	POST /chat/completions
search	Web-search models inside /chat/completions
images	POST /images/generations, POST /images/edits
video	All /videos endpoints
music	All /audio/music endpoints
audio	POST /audio/speech, POST /audio/transcriptions
embeddings	POST /embeddings

A key with every scope selected reaches the whole catalog. A request outside the allowed scopes returns 403.

Scope each key to its job: a key that sits in a browser extension and can only do chat will not burn your balance on video if it leaks.

Storage

The key is access to your balance. Treat it like any payment secret:

• environment variables or a secret manager, never the repository;
• never in client-side code — the browser and mobile apps hand the key to anyone who opens DevTools;
• one key per application and environment, so revoking one does not take down the rest;
• if you suspect a leak, delete the key in your account — that takes effect immediately.

Checking a key

curl https://api.mixen.ai/v1/chat/completions \
  -H "Authorization: Bearer $MIXEN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-5.6-luna","messages":[{"role":"user","content":"ping"}],"max_tokens":5}'

A 401 means the key is missing or revoked. A 402 means the key works but the balance is too low.