---
title: Authentication and keys
description: Send a Sume API key on every request to the public API.
---
Every request to the public API carries an API key. Requests without one get `401 unauthorized`.

## Send the key

Use either header:

```http
Authorization: Bearer sume_live_...
```

```http
x-api-key: sume_live_...
```

Send one of them, not both. Keep keys on your server: a key in a browser or a mobile app can be copied and spent.

## Your key

Make keys in [open.sume.com → API keys](https://open.sume.com/api-keys). A key spends your open.sume.com balance, in US dollars. It calls the model API and nothing else:

| Area | Operations |
|---|---|
| Images | [Generate](/docs/reference/images/generate), [list models](/docs/reference/images/list-models), [get a model](/docs/reference/images/get-model) |
| Video | [Generate](/docs/reference/video/generate), [list models](/docs/reference/video/list-models), [get a model](/docs/reference/video/get-model) |
| Jobs | [Status](/docs/reference/jobs/status), [result](/docs/reference/jobs/result), [get](/docs/reference/jobs/get), [list](/docs/reference/jobs/list), [cancel](/docs/reference/jobs/cancel), events and [webhook redelivery](/docs/webhooks) |
| Uploads | [Direct upload](/docs/input-media) of your own image or video |
| Prices | [Open models](/docs/reference/catalog/list) and [estimates](/docs/reference/catalog/estimate) (these two need no key) |

Any other route answers `403 open_key_route_not_allowed`:

```json
{
  "error": {
    "code": "open_key_route_not_allowed",
    "message": "This key is an open.sume.com key: it calls the model API (Video Router, Image Router, jobs) only.",
    "request_id": "req_aa5af5e640fc4deab1a01d4dbe36d377",
    "category": "validation",
    "stage": "validation",
    "retryable": false,
    "retry_after_seconds": null,
    "public_reason": "open_key_route_not_allowed",
    "next_action": "fix_input"
  }
}
```

Keys made in a team (an organization) belong to the team. Every member can use them, and their runs spend the team's balance.

## One host

Every call in these docs goes to `https://api.open.sume.com`. It takes API keys only: a signed-in browser session sent there gets `401 session_not_accepted`. Each response names the host that answered in the `x-sume-api-surface` header (`public`).

## Rotate a key

Create the new key, deploy it, then revoke the old one in the dashboard. A revoked key gets `401 unauthorized` at once.