Authentication and API keys

Every /v1/* request needs a bearer key:

Authorization: Bearer vana_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Prefix	Use
`vana_live_`	production traffic, paid from your prepaid balance
`vana_test_`	development / CI; same model and limits, also paid from your balance (tracked per key)

Keys are random 40-character strings after the prefix. Vana stores only a SHA-256 hash; the full key is shown once when created and cannot be recovered — create a new one if lost.
Keys belong to your organisation (customer). Rate limits apply per key (requests/minute); usage is paid from the organisation's prepaid balance (see pricing); GET /v1/balance shows it.
Rotate a key from the dashboard: a new key is issued and the old one is revoked immediately. Revoked keys get 401 authentication_error (within ~10 seconds across all servers).
Never ship keys in browser or mobile code; call Vana from your backend (or an edge function).
GET /health needs no key.

A $0 balance returns 402 insufficient_balance; a suspended or canceled account returns 403 subscription_inactive. See errors.