Authentication
Every request to /v1/* must include a bearer API key. Keys are created and revoked from the Developer Console.
Key format
Keys are prefixed cai_live_ and shown in full exactly once, at creation time — CAILegal only ever stores a SHA-256 hash of the key server-side, so if you lose a key you must revoke it and create a new one. Send it as a standard HTTP bearer token:
Authorization: Bearer cai_live_AbCdEfGh...curl https://<base-url>/v1/chat/completions \
-H "Authorization: Bearer cai_live_YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"message": "..."}'Scopes
Each key carries a list of scopes limiting which endpoint families it may call. Request only the scopes your integration needs when creating a key.
| Scope | Grants access to |
|---|---|
| chat | Chat endpoints |
| documents | Documents endpoints |
| compliance | Compliance endpoints |
| corporate | Corporate endpoints |
| litigation | Litigation endpoints |
| audit | Audit endpoints |
| contracts | Contracts endpoints |
A request made with a key missing the required scope for an endpoint returns 403 Forbidden. GET /v1/status is the one exception — it requires no API key at all.
Key lifecycle
- Revoking a key takes effect immediately — any in-flight or new request with that key returns
401 Unauthorized. - Keys can optionally be created with an expiry date and rotated (create a replacement, run both during a grace period, then revoke the old key).
- Sandbox keys (see Sandbox Mode) never touch billing and never call the underlying model.
Next: Errors & Rate Limits →