Authentication

Every request to the Power API except the model catalog must include a bearer token in the Authorization header:

Authorization: Bearer <token>

The model catalog (GET /v1/models and GET /v1/models/{owner}/{model}/schema) is public and requires no authentication.

API keys are the credential for all developer integrations. They have the prefix wpe_ and are looked up by SHA-256 hash on every request.

Creating a key

1. Open the Power console.
2. Select the project the key will belong to.
3. Go to API keys → Create key.
4. Choose a permission preset:
   • all — write on every scope.
   • read_only — read on every scope.
   • restricted — custom per-scope mapping.
5. Copy the secret. It is displayed once.

Treat keys as secrets

The Power console stores only a SHA-256 hash of the secret. We cannot recover the value for you. If it’s lost, rotate the key and update your clients.

Scopes

Each request maps to one scope. API keys are authorised per scope; an Authorization header that resolves to a key without the required scope returns 403.

Scope	Endpoints
chat:write	POST /v1/chat/completions, content endpoints
image:write	POST /v1/images/generations, POST /v1/images/alt-text
speech:write	POST /v1/audio/speech
transcribe:write	POST /v1/audio/transcriptions

Rotation

API keys do not expire on their own. Rotate them on a schedule that matches your security policy:

1. Create a new key in the Power console.
2. Deploy the new key to your application.
3. Revoke the old key in the Power console.

Rotation is a Power console action; there is no rotation endpoint for customers in the Power Beta.