Skip to main content
All API requests require an API key; only the root liveness path / is open. Authentication is handled at the API Gateway layer before requests reach the application.
Enterprise organizations with SSO connected to the Consus portal don’t have to handle keys at all. With the credential helper installed, your AI tool signs you in with your company account and fetches its own key.

​
System Use Notification

This is a U.S. Government information system. By accessing this system, you acknowledge and consent to the following:
  • This system is provided for authorized use only.
  • Usage may be monitored, recorded, and subject to audit.
  • Unauthorized use of this system is prohibited and subject to criminal and civil penalties.
  • Use of this system constitutes consent to monitoring and recording.
This notice satisfies NIST SP 800-53 AC-8 (System Use Notification) for programmatic API access.

​
Passing Your API Key

Include your key in the x-api-key header:
When using the OpenAI SDK, pass it via default_headers:
The OpenAI SDK requires an api_key value and sends it as a Bearer token in the Authorization header. When a request carries both headers, x-api-key wins, so the placeholder api_key above is never used. Your key is validated at the API Gateway layer before your request reaches the application.

​
Bearer tokens

x-api-key is the default and recommended header. For clients that can’t set custom headers, Consus Gateway also accepts your key as a standard Bearer token:
With a Bearer-only client, pass your Consus API key as the client’s normal API key setting. Examples: api_key in the OpenAI SDK, LangChain or LiteLLM, or the API key field in Goose or the Vercel AI SDK. No header override is needed. The key is validated exactly as it is in x-api-key, and the same rate limits and quotas apply. If a request carries both headers, x-api-key wins.

​
Rate Limits

See Rate Limits for API key limits and per-model upstream limits.

​
Error Responses

​
Key Management

To get an API key or adjust rate limits, book a call with our team. To manage your organization’s keys from your own tooling, use the Management API.

​
Key lifecycle

  • Keys expire after 12 months. The Consus portal flags a key two weeks before its date. To rotate, create a new key in the portal, switch your tools to it, then revoke the old one.
  • Sign-in keys last 30 days. A key from SSO sign-in expires after 30 days, and the helper signs you in again the next time your tool asks for a key.
  • Idle keys are turned off. A key with no requests for 35 days is disabled. Ask Consus support to turn it back on, or create a new key in the portal.
  • Turned-off keys are deleted. A key that has been disabled or revoked for at least 30 days is deleted for good. Its spend history stays in your organization’s reports.
An expired key gets 403 with the type key_expired. See Errors.