Authentication
Bearer keys, scopes, rotation, and request identity.
All API requests require a valid API key. Pass it in the Authorization header using Bearer authentication. Keys are project-scoped secrets - treat them like production database credentials.
Authorization: Bearer eridian_sk_...API Keys
Each Eridian project has its own set of API keys. Keys are scoped to the project and can be granted granular permissions:
| Scope | Description |
|---|---|
inference:read | Read inference responses and status |
inference:write | Create inference requests |
models:read | List available models |
usage:read | Read usage and cost data |
keys:manage | Create, rotate, and revoke API keys |
budgets:manage | Create and modify budgets |
rag:write | Upload and manage RAG documents |
templates:manage | Create and modify prompt templates |
audit:read | Export audit log events |
governance:manage | Modify webhooks and policy settings |
dev:read / dev:write | Eridian Dev repositories, reviews, Q&A, tests |
legal:read / legal:write | Eridian Legal matters, contracts, mappings, redlines |
ops:read / ops:write | Eridian Ops incidents, logs, post-mortems, connectors |
risk:read / risk:write | Eridian Risk cases, evidence, assessments, reports |
risk:approve | Approve gated Risk actions (Enterprise alias of dual control) |
Vertical keys should carry the matching *:write scope plus inference:write. A Dev CI key does not need legal:write. See Eridian Dev, Eridian Legal, Eridian Ops, and Eridian Risk.
Create Key
POST /v1/keys
Authorization: Bearer eridian_sk_...
Content-Type: application/json{
"project_id": "prj_legal_001",
"name": "production-inference",
"scopes": ["inference:write", "models:read"],
"budget_usd": 10000
}The full key is returned once at creation. Store it securely - it cannot be retrieved again.
Key Rotation
Rotate your API key without downtime:
- Create a new key with the same scopes.
- Update your application to use the new key.
- Verify the new key works against a canary project.
- Revoke the old key.
Rotated keys maintain a 24-hour overlap window when configured, allowing zero-downtime rotation across distributed services.
Key Lifecycle Audit Events
| Action | Scope required | Audit event |
|---|---|---|
| Create key | keys:manage | key.create |
| Rotate key | keys:manage | key.rotate |
| Revoke key | keys:manage | key.revoke |
| List keys | keys:manage | key.list |
Rate Limits
Default rate limits by plan:
| Plan | Requests/min | Tokens/min |
|---|---|---|
| Starter | 60 | 100,000 |
| Growth | 300 | 500,000 |
| Enterprise | Custom | Custom |
Rate limit headers are included in every response:
X-Eridian-RateLimit-Limit: 300
X-Eridian-RateLimit-Remaining: 247
X-Eridian-RateLimit-Reset: 1718400000Budget-Scoped Keys
Assign monthly budget ceilings per key. When a key approaches 80% or 95% of budget, webhook and email alerts fire. Hard-stop keys return HTTP 429 with error.code: budget_exceeded.
Base URL
| Environment | Base URL |
|---|---|
| Production | https://api.geteridian.com |
| API Version | v1 |
SSO and Dashboard Access
Enterprise tenants authenticate operators via SAML 2.0 (Okta, Azure AD, Google Workspace, OneLogin). SCIM provisioning synchronizes users and group memberships. Dashboard sessions honor configurable timeout policies and optional IP allowlists.
Error Codes
| HTTP | Code | Meaning |
|---|---|---|
| 401 | invalid_api_key | Key missing, revoked, or malformed |
| 403 | insufficient_scope | Valid key lacking required scope |
| 429 | rate_limit_exceeded | Per-minute request or token limit hit |
| 429 | budget_exceeded | Key or project budget hard stop |
See API Keys for create/rotate/revoke, Governance for budget configuration, and Quickstart for the first authenticated call.
Production API credentials are issued with an institution workspace. Contact sales if you need access.