Authentication

All Lurus API requests require authentication. Two complementary modes are supported; choose one based on your scenario:

API Key Quickest to start

Bearer Token, ideal for scripts and personal projects. Covered on this page.

OIDC / OAuth2 Token

Built on the unified identity system, ideal for apps requiring user login, enterprise SSO, and M2M. See OIDC Integration and PAT / JWT.

Authentication Methods

Use a Bearer TokenBearer TokenAn HTTP authentication scheme that carries the credential in the request header as "Bearer sk-xxx". to carry your API KeyAPI KeyA secret credential for accessing the API, much like a password. Each Key can have its own quota and permissions.Learn more → in the HTTP header:

Authorization: Bearer sk-your-api-key

Request Example

curl https://hub.lurus.cn/v1/chat/completions \
  -H "Authorization: Bearer sk-your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"model": "deepseek-chat", "messages": [{"role": "user", "content": "Hi"}]}'

Python

from openai import OpenAI

client = OpenAI(
    base_url="https://hub.lurus.cn/v1",
    api_key="sk-your-api-key",  # 建议改为 os.environ.get("LURUS_API_KEY")
)

Node.js

import OpenAI from 'openai';

const client = new OpenAI({
  baseURL: 'https://hub.lurus.cn/v1',
  apiKey: 'sk-your-api-key',  // 建议改为 process.env.LURUS_API_KEY
});

For the full SDK list, see API Overview — SDK Support.

Environment Variables

We recommend storing your API Key in an environment variable to avoid hardcoding it:

# .env
LURUS_API_KEY=sk-your-api-key

import os
from openai import OpenAI

client = OpenAI(base_url="https://hub.lurus.cn/v1", api_key=os.environ.get("LURUS_API_KEY"))

Authentication Errors

Status Code	code	type	Common Causes
401 Unauthorized	invalid_api_key	authentication_error	Malformed key / disabled or deleted / incorrect Authorization header format
403 Forbidden	access_denied	authorization_error	Key lacks permission for the model / account suspended / quota exhausted

For the error response JSON structure and retry strategy, see Error Handling.

Security Best Practices

Use environment variables

Do not hardcode the API Key in your code

Keep it private

Do not commit it to a Git repository

Restrict permissions

Grant the key only the minimum permissions it needs

Rotate regularly

Replace the API Key periodically

Monitor logs

Review API call logs regularly

---

Next Steps

Chat Completions APIError HandlingAPI OverviewOIDC Integration