Authentication
The API authenticates requests with a personal API key sent as a Bearer token — exactly like the OpenAI API.
Creating a key#
Open the Console, sign in with your Whalli account, and click Create key. Your key is shown once — copy it immediately; it cannot be retrieved later.
Treat your key like a password. It can spend your credits. Never commit it to source control or expose it in client-side code. If a key leaks, revoke it in the Console.
Making an authenticated request#
Pass the key in the Authorization header:
http
Authorization: Bearer wh_live_...bash
curl https://api.studio.whalli.com/v1/models \
-H "Authorization: Bearer $WHALLI_API_KEY"Key format & scopes#
Keys are prefixed with wh_live_. When you create a key you can restrict it to specific scopes (chat, images, audio, music, sfx, video) and to a list of allowed models. A key with no scopes selected has full access. A request outside a key's scope returns 403 insufficient_scope.
Revoking#
Revoke a key from the Console at any time. Revocation is immediate — the next request with that key returns 401. Past usage stays attributed to the key for your records.
Keys are stored only as a hash — Whalli never stores the plaintext. That's why a key can't be shown again after creation.