Authentication

The API authenticates requests with a personal API key sent as a Bearer token — exactly like the OpenAI API.

Creating a key#

Open the Console, sign in with your Whalli account, and click Create key. Your key is shown once — copy it immediately; it cannot be retrieved later.

Treat your key like a password. It can spend your credits. Never commit it to source control or expose it in client-side code. If a key leaks, revoke it in the Console.

Making an authenticated request#

Pass the key in the Authorization header:

http
Authorization: Bearer wh_live_...
bash
curl https://api.studio.whalli.com/v1/models \
  -H "Authorization: Bearer $WHALLI_API_KEY"

Key format & scopes#

Keys are prefixed with wh_live_. When you create a key you can restrict it to specific scopes (chat, images, audio, music, sfx, video) and to a list of allowed models. A key with no scopes selected has full access. A request outside a key's scope returns 403 insufficient_scope.

Revoking#

Revoke a key from the Console at any time. Revocation is immediate — the next request with that key returns 401. Past usage stays attributed to the key for your records.

Keys are stored only as a hash — Whalli never stores the plaintext. That's why a key can't be shown again after creation.