Authentication
The MomoyAI API uses HTTP Bearer authentication:
Authorization: Bearer YOUR_API_KEYSecurity practices
Section titled “Security practices”- Keep API keys in server-side secret storage or environment variables.
- Use separate keys for each environment and application.
- Redact the
Authorizationheader and sensitive user input from logs. - Rotate a key immediately if you suspect exposure.
- Browser applications should call your own backend, which then calls MomoyAI.
Authentication failures
Section titled “Authentication failures”401 Unauthorized usually means the key is missing, invalid, or not using the Bearer format. Check the actual runtime header and remove accidental whitespace.
curl -i https://cpa.momoyai.com/v1/models \ -H "Authorization: Bearer $MOMOYAI_API_KEY"