Skip to content
inferiq

Guides

Authentication

People sign in to the console with an EVM wallet. Coding tools and code call the API with Inferiq keys. The two never mix.

Two kinds of access

Console sign-inAPI key
Who uses itA person, in the browserYour coding tool, script or server
HowSign-In with Ethereum (EIP-4361)Authorization: Bearer iq_…
GrantsManaging keys, limits, rules and your balanceOnly the scopes on the key, paid from your balance
Lifetime7-day session cookieUntil it expires or is revoked

Console sign-in with a wallet

There are no email accounts or passwords. Your wallet address is your identity, and the first address to sign in owns the workspace.

  1. Connect

    On /login, pick a wallet. Rabby is recommended; any browser wallet that announces itself through EIP-6963 (MetaMask and others) is listed too.

  2. Sign a one-time message

    The server issues a single-use nonce that expires in 10 minutes. Your wallet shows a message like this one. Check that the domain matches the site you’re on before you sign:

    Message shown in your wallet
    localhost:3000 wants you to sign in with your Ethereum account:
0xe86240653769904C9Df1df735C6828b5af6a7315

Sign in to Inferiq. This request will not trigger a blockchain transaction or cost any gas.

URI: http://localhost:3000
Version: 1
Chain ID: 1
Nonce: 3f9a1c0b7d2e4f68
Issued At: 2026-10-16T14:32:00.000Z
Expiration Time: 2026-10-16T14:42:00.000Z

  3. Verified, signed in

    The server checks the domain, nonce, expiry and signature, then sets an httpOnly session cookie. Smart-contract wallets (ERC-1271) are supported through an on-chain check.

What signing does and doesn’t do

Signing is free and off-chain. It proves you control the address for this one sign-in. It doesn’t send a transaction, approve tokens or move funds. Inferiq will never ask for your seed phrase or private key.

Switching wallets

If you switch accounts in your wallet while signed in, the console shows a banner. Choose Sign in with the new wallet to end the current session and sign again.

Mobile wallets

WalletConnect (scan a QR code with a phone wallet) is planned.

API keys for tools and code

  • Create keys in API keys. Keys are free, so use one per tool or machine: you can see what each one spends and revoke one without touching the others.
  • When you create a key, choose the models it may use: aliases (inferiq/fast, inferiq/balanced, inferiq/best), exact model ids, or all models. A request for any other model fails with model_not_allowed (403), and GET /v1/models lists only what the key may use. The check matches the model you send, so allowing an alias doesn’t allow its exact model ids.
  • Keys start with iq_. The full key is shown once; Inferiq stores only a SHA-256 hash and a short prefix for display.
  • Scopes: inference to send model requests, fix to run fix agents. A fix key limited to certain models must also allow the tier’s alias, such as inferiq/balanced.
  • A key can carry a daily spending limit. Once the day’s spend plus a request’s worst case would pass it, requests fail with budget_exceeded until midnight UTC.
  • Send the key as Authorization: Bearer iq_…. The Anthropic-style x-api-key header is accepted too.
  • Keep keys out of browser code and public repositories. On your own machine, put them in your tool’s settings or an environment variable.
Using a key
curl $INFERIQ_BASE_URL/models \
  -H "Authorization: Bearer $INFERIQ_API_KEY"

Rotating and revoking keys

  1. Create the replacement

    Create a new key with the same scopes and models, and put it in your tool or deployment next to the old one.

  2. Confirm traffic moved

    Watch Last used on both keys. When the old key stops being used, it’s safe to remove.

  3. Revoke the old key

    Revocation is immediate. Requests with that key fail with key_revoked, and the action is recorded in the audit log.

Previous Connect your toolNextModels & fallback