Authentication

Authenticate production and test API requests.

CarHub API keys authenticate your server, worker or trusted backend. Use the key that matches the environment you are calling.

Inference API keys

Use an organisation API key for /v1/* and /mcp.

Authorization: Bearer chk_live_… or chk_test_…

Key prefix	Inference	Credits	livemode
chk_live_	Production models	Live balance	true
chk_test_	Deterministic fixtures	Test balance	false

The secret is shown once when you create or rotate a key. Store it in a secret manager. CarHub stores only a hash and later displays the key prefix.

Keys can be restricted to endpoint families. A call outside the allowed scope returns 403 scope_not_granted.

Use a chk_test_ key while you build and verify error handling. It exercises the same authentication, rate limits, idempotency, job lifecycle and webhook delivery as a live key. Only model execution is replaced by a deterministic fixture. See test mode.

The inference API intentionally does not return CORS headers. Call it from your server, worker or trusted backend—not directly from browser code.