Authentication

Pendra authenticates every request with a single API key. Keys are scoped to a Pendra organisation; rotate or revoke them at any time from the console without losing usage history.

Key format

Keys start with the literal prefix pdr_sk_ followed by a 32-byte URL-safe random string. Pendra stores only a SHA-256 hash of the key, so the raw value is shown exactly once at creation — save it immediately.

pdr_sk_xQ8yX...    # ~50 characters total

How to send the key

Pendra accepts the key on either of two headers; pick whichever your SDK uses.

Authorization: Bearer (recommended)

curl https://api.pendra.ai/api/v1/chat/completions \
  -H "Authorization: Bearer pdr_sk_..." \
  -H "Content-Type: application/json" \
  -d '{"model":"qwen3.6:27b","messages":[{"role":"user","content":"Hello"}]}'

x-api-key (Anthropic SDK compatibility)

The Anthropic Messages endpoint at /v1/messages also accepts x-api-key, which is how the official Anthropic SDK and Claude Code send credentials.

curl https://api.pendra.ai/v1/messages \
  -H "x-api-key: pdr_sk_..." \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{"model":"qwen3.6:27b","max_tokens":256,"messages":[{"role":"user","content":"Hello"}]}'

Key permissions

Every key carries a set of permissions, chosen when you create it in the console:

• Inference — chat, embeddings, images, audio, and model listings. Every key has this; there's no way to create a key without it.
• GPU rental — rent and stop on-demand GPUs. Off by default, because it spends money — tick it in the console when you create the key if you need to rent from your own code.
• Usage & workers: read your usage log, in-progress requests and worker status. Off by default, and read-only. Tick it for a monitoring job, or for a service that needs to confirm a cancelled request has stopped before it retries.
• Manage workers: change worker and model settings, such as a model's context size, and install or remove models. Off by default. Only works for a key created by an owner or operator. Approving and removing workers stays in the console.

Keys created before permissions existed are unrestricted and can already do everything, including renting GPUs. If that's broader than you want, create a replacement key with only the permissions you actually need and revoke the old one — revoking takes effect immediately.

A key that's missing a permission a request needs gets a 403 with a detail message naming the missing permission, rather than a generic "forbidden":

{"detail": "API key is missing the required scope: usage:read"}

The names you'll see there map to the console's checkboxes like this:

• inference:write and models:read: Inference
• compute:read and compute:write: GPU rental
• usage:read and workers:read: Usage & workers
• workers:write: Manage workers

Permissions are fixed when a key is created. To add one to an existing key, create a replacement key with the permissions you need, deploy it, then revoke the old one.

Creating and rotating keys

1. Sign in to the Pendra console.
2. Open API Keys from the sidebar.
3. Click Create key, give it a name (e.g. "production server"), and copy the resulting pdr_sk_ value.
4. Store the key in your secret manager. The raw key cannot be retrieved again.

To rotate, create a new key, deploy it, then delete the old one. Deleted keys stop working immediately; existing usage logs remain.

Scopes & limits

• Every key belongs to exactly one organisation.
• A key with the default (inference) permission can call any inference endpoint (/chat/completions, /embeddings, /images/generations, /audio/transcriptions, /v1/messages, /v1/responses) and read-only listings (/models, /catalogue). A key with the GPU rental permission can also rent, poll, and stop on-demand GPUs. A key with the Usage & workers permission can also read your usage log, in-progress requests and worker status (/usage/*, /workers, /workers/events, /workers/{worker_id}/power). A key with the Manage workers permission can also change worker and model settings.
• Console-only actions (managing keys, billing, worker provisioning, approving or removing workers, turning on remote image URLs or web tools for a worker, and GPU rental budgets/auto-stop) sign in with your Pendra account instead of an API key — do those in the console UI. Calling one of those endpoints with any API key gets a 403 saying it needs a signed-in console session. That response doesn't check the key, so to confirm a key works, call an endpoint it's allowed to use, such as /models.