Authentication

Get an API key, secure it, and use it on every request

Every MuleRouter endpoint requires an API key, passed in the Authorization request header.

Get an API key

1. Open the API Keys tab

   Sign in to the MuleRouter Console and open the API Keys tab.

2. Generate a new key

   Click Generate new key. The console shows the full key string exactly once — copy it to a secret store immediately.

3. (Optional) Restrict the key

   Add a description so you remember what the key is for. Rotate or revoke individual keys at any time from the same page.

The full API key is shown only once at creation. If you lose it, you cannot recover it — generate a new one and rotate.

Send authenticated requests

Include the key as a Bearer token in the Authorization header:

Authorization: Bearer <API Key>

A minimal cURL request:

curl https://api.mulerouter.ai/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $MULEROUTER_API_KEY" \
  -d '{"model":"gpt-5.5","messages":[{"role":"user","content":"hi"}]}'

The same header works for every endpoint — LLM, image, video, speech, music, async tasks, and the task-status GET URLs.

SDK setup

Most OpenAI-compatible SDKs accept a base_url override. Point it at MuleRouter and they “just work”:

OpenAI Python

from openai import OpenAI

client = OpenAI(
    api_key=os.environ["MULEROUTER_API_KEY"],
    base_url="https://api.mulerouter.ai/v1",
)

Best practices

• Never commit keys to source control. Use environment variables, .env files (gitignored), or a secret manager.
• Rotate aggressively. Generate a new key when a teammate leaves, when you suspect a leak, or on a fixed cadence.
• One key per workload. Per-service keys make leaks easy to scope and revoke without disrupting unrelated traffic.
• Server-side only. Treat the key like a database password — never ship it in a browser bundle or mobile app.

Errors

HTTP	Meaning	Likely cause
401 Unauthorized	Missing, malformed, or revoked key	Check the Authorization header is Bearer <key>
402 Payment Required	Insufficient balance	Top up in the Console
429 Too Many Requests	Rate limit / quota / daily-spend cap	Slow down or raise the limit

The full code list lives in Error codes.