Authentication
All API endpoints are authenticated using API Subscription Keys provided by Sarvam AI when you sign up. Include these keys in the header of each API request as follows:
Bearer token (alternative)
The API also accepts the same key as a standard Authorization: Bearer header on all endpoints:
This is useful with OpenAI-compatible tooling pointed at the Chat Completions endpoint (/v1/chat/completions), which conventionally sends Bearer auth. All examples in these docs and the official SDKs use the api-subscription-key header — prefer it unless your tooling requires Bearer.
Obtaining Your API Subscription Key
- Sign Up: Create an account on the Sarvam Dashboard
- Generate Key: After signing up, you must manually generate your API key from the dashboard. Navigate to the API Keys section and create a new key for your account.
- Organisation Key Management: Creating Organisational level keys is not currently supported and will be available soon.
Best Practices for API Key Management
- Keep Your Key Secret: Never expose your API key in public repositories or client-side code.
- Use Environment Variables: Store your API key in environment variables rather than hardcoding it in your application.
- Monitor Usage: Regularly check your API usage on the Sarvam dashboard. You should be able to see the credits utilised & remaining
Using the API Subscription Key
To authenticate your requests, include the API-Subscription-Key in the headers of your HTTP requests. Here’s an example using SarvamAI SDK:
Status Codes for Authentication Failures
Auth failures return HTTP 403, not 401. Sarvam returns 403 Forbidden for both invalid/missing API keys and forbidden-but-authenticated requests. If you’re catching exceptions or branching by status code, handle 403 as covering both “forbidden” and “invalid/missing API key”.
The response body’s error.code distinguishes the two:
invalid_api_key_error— the key is missing, malformed, or unknown- other
*_errorcodes — authenticated but not allowed for the requested resource