Authentication

Every request to api.brime.dev must carry a valid Brime API key in the Authorization header.

API key format

Brime keys look like:

sk-brime-...

Prefix: sk-brime-
Treat them like a password — they grant full access to your account's credit balance and rate-limit budget.

Sending the key

from brime import Brime

# Explicit
client = Brime(api_key="sk-brime-...")

# Or pick up BRIME_API_KEY from the environment
client = Brime()

import { Brime } from "@brime-ai/brime";

const client = new Brime({ apiKey: "sk-brime-..." });
// or
const client = new Brime(); // uses BRIME_API_KEY env var

curl https://api.brime.dev/v1/search \
  -H "Authorization: Bearer sk-brime-..." \
  -H "Content-Type: application/json" \
  -d '{"query":"hello"}'

Environment variables

The Python and Node.js SDKs both honour:

Variable	Purpose	Default
`BRIME_API_KEY`	Your API key	— (required)
`BRIME_BASE_URL`	API base URL (override for staging)	`https://api.brime.dev`

Adapter authentication

If you're using Brime through a drop-in adapter (Tavily / Exa / Parallel), the same Brime key works:

from tavily import TavilyClient

client = TavilyClient(
    api_key="sk-brime-...",                      # Brime key
    api_base_url="https://api.brime.dev/tavily",
)

from exa_py import Exa

client = Exa(
    api_key="sk-brime-...",
    base_url="https://api.brime.dev/exa",
)

from parallel import Parallel

client = Parallel(
    api_key="sk-brime-...",
    base_url="https://api.brime.dev/parallel",
)

Key lifecycle

From the dashboard, click Create API key. Optionally label keys (prod, staging, bench) so usage logs are easy to filter.

To rotate, mint a new key, swap it in your environment, then revoke the old one. There's no downtime — both keys work until you revoke.

Click Revoke on any key. Future requests with that key get 401 unauthorized immediately (no cache TTL).

Security best practices

Never commit keys to git. Use .env files, GitHub Actions secrets, or a secret manager.
One key per environment. Separate keys for prod, staging, and CI; revoking one shouldn't break the others.
Use the dashboard's audit log to review who used a key, when, and from where.
Rotate quarterly as a hygiene practice; immediately if you suspect leak.

Errors

Error code	Status	Meaning
`unauthorized`	401	Missing, malformed, or revoked key
`insufficient_credits`	402	Account balance is zero for the current period
`rate_limited`	429	Per-key rate limit hit; check `X-RateLimit-*` headers

See the Errors reference for the full catalog.