Authentication

There are two auth schemes, one per service. Each capability's page states which one it uses.

Which key goes where

Credential	Send it as	Works on
Gateway partner key (`sk-partner-…`)	`Authorization: Bearer …`	`https://ai.ollalink.com` — chat, translation, gateway STT/TTS, diarization, media
Speech GPU access key (`nhgpu_…`)	`X-NH-GPU-Key: …` header	every `gpu-*.ollalink.com` capability (REST and WebSocket)
Dashboard API key (`sk_…`)	`session.configure.api_key`	the realtime speech-to-speech stream (available on request)

They are not interchangeable: a key that returns 401/403 on a host it was never issued for is not stale — it is the wrong credential for that host. Keep all of them labelled in your secret store.

Gateway — Bearer key

For everything on https://ai.ollalink.com, send your partner key as a Bearer token:

HTTP Header

Authorization: Bearer sk-partner-XXXXXXXXXXXXXXXXXXXXXXXX

OpenAI-compatible: point any OpenAI SDK's base_url at https://ai.ollalink.com/v1 and set api_key to your partner key.
Missing / invalid key → HTTP 401.

Speech GPU — access header

For the realtime, high-accuracy, and studio capabilities on gpu-*.ollalink.com, send:

HTTP Header

X-NH-GPU-Key: nhgpu_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

These lanes are OpenAI-compatible too — point base_url at the capability's hostname and pass the header via your SDK's default_headers. No separate Bearer token is required.
Missing / wrong key → HTTP 403 (blocked at the edge, before it reaches any GPU).

python (Speech GPU OpenAI SDK)

from openai import OpenAI

client = OpenAI(
    base_url="https://gpu-code.ollalink.com/v1",
    api_key="unused",
    default_headers={"X-NH-GPU-Key": "nhgpu_XXXX"},
)

Key handling

Keys are issued per partner and independently revocable — a leaked key is rotated for you alone; no other partner is affected.
Never embed a key in client-side / browser / mobile code. Call from your backend only.
Do not share or proxy your key to third parties.
To rotate, revoke, or raise limits, contact your ollalink technical contact — rotation is instant and scoped to you.

Error codes

Code	Meaning
`200`	OK
`400`	Malformed request, or the input exceeds the model's context limit
`401`	Missing / invalid Bearer key (Gateway)
`403`	Missing / wrong access header (Speech GPU)
`404`	Wrong path for that capability
`429`	Rate limited — see Rate limits below
`502`	A capability is restarting / loading — retry shortly
`5xx`	Upstream error

Repeated auth failures (IP blocking)

To protect the platform, our edge automatically blocks a source IP that produces many authentication failures in a short window — for example retrying a rejected key in a loop, or sending the wrong credential for a host.

⚠️ Critical Network Rule: A block is enforced at the network level, so requests from that IP then hang and time out with no HTTP response — not a clean 401 / 403. If ai.ollalink.com times out while gpu-* hosts still respond, your IP is likely blocked on the Gateway edge.

Avoid it: Stop and fix auth on the first 401 / 403 — do not hammer a failing key.
Allowlist egress IPs: Send your backend's egress IP address(es) to your technical contact before running load tests to be permanently allowlisted.

Rate limits

Both services are rate-limited at the edge. Limits are generous — normal interactive use will not hit them. For high-volume load testing or enterprise batch runs, contact the engineering team for custom quota allocations.

← Previous Getting started Next → Features Directory