generated: '2026-08-11'
method: searched
source: >-
  https://infer.flow7.org/docs and https://infer.flow7.org/openapi-public.json — the docs upgrade the
  spec's single securityScheme with the key types, environments, scope name and handling rules Infer
  publishes but does not encode in the OpenAPI.
description: >-
  Infer exposes exactly one authentication mechanism: an HTTP Bearer API key issued inside a
  workspace. There is no OAuth 2.0, no OIDC, no mTLS and no signed-request scheme. Two of the four
  published operations are deliberately unauthenticated (public catalog and public status), which is
  what makes the price and availability surface machine-readable without an account.
base_url: https://infer.flow7.org
schemes:
  - id: bearerAuth
    type: http
    scheme: bearer
    bearer_format: Infer API key
    in: header
    header: Authorization
    value_format: "Bearer <workspace API key>"
    source: components.securitySchemes.bearerAuth
    description: >-
      Workspace-scoped API key. Infer's spec description explicitly instructs that the key must not be
      placed in a URL, a prompt, a support request, or public diagnostic output; the same rule is
      repeated in all three published agent skills, which tell an agent to read INFER_API_KEY from the
      environment and never to ask a user to paste a key into chat.
    applies_to:
      - listModels
      - createResponse
key_model:
  issuance: >-
    Self-serve. Create a workspace at /signup, confirm the one-time email verification link, then
    create a key in the API keys area. Keys are shown once.
  storage_by_provider: hashed (stated in the Privacy Notice, section 9 Security)
  environments:
    - name: sandbox
      key_env_var_convention: INFER_SANDBOX_API_KEY
      requires_funding: false
      note: >-
        Sandbox keys run only Infer's local demo fixture. A sandbox response carries
        relay.environment = "sandbox" and relay.resolved_model_class = "Infer local sandbox fixture".
    - name: live
      key_env_var_convention: INFER_API_KEY
      requires_funding: true
      note: A live key cannot send paid inference until the prepaid wallet is funded ($20 first funding).
  scopes:
    - name: inference:write
      required_by:
        - listModels
        - createResponse
      source: >-
        https://infer.flow7.org/openapi-public.json — listModels description: "The key must carry the
        inference:write scope."
      note: >-
        This is an API-key permission scope, NOT an OAuth 2.0 scope. There is no authorization server
        and no scope-grant flow; the scope is attached to the key when it is created.
  spend_controls:
    - control: per-key daily spend ceiling
      unit: microdollars
      note: >-
        Enforced before a request is admitted, not after settlement. Observed in Route Note 005: a key
        with a $0.010000 daily and monthly ceiling admitted one request and rejected seven concurrent
        contenders with HTTP 429 daily_budget_exceeded.
    - control: per-key monthly spend ceiling
      unit: microdollars
  revocation: >-
    Keys are revocable from the workspace. Infer's own published test records state the temporary
    bounded keys were revoked after every task reached a terminal state.
unauthenticated_surface:
  - operation: getPublicCatalog
    path: GET /api/public/catalog
    note: Full published price catalog including per-million token rates, privacy modes and price versions.
  - operation: getPublicStatus
    path: GET /api/public/status
    note: Per-service operational state and p95 latency for every published model.
failure_modes:
  - status: 401
    code: invalid_api_key
    meaning: Missing, revoked, or invalid key.
  - status: 403
    meaning: The key, organization, environment, or scope cannot perform this operation.
  - status: 402
    code: insufficient_credits
    meaning: The wallet cannot cover the request's reservation.
docs: https://infer.flow7.org/docs
related:
  - conventions/infer-by-flow7-conventions.yml
  - errors/infer-by-flow7-problem-types.yml
  - scopes/infer-by-flow7-scopes.yml