Authentication
Every call that runs a model carries an API key — sk-eva-… — as a bearer token. ChatGPT and Claude go through an OAuth 2.1 connector instead, with three rights you approve.
SoonOpening soon: what follows describes the service as it will work.
API keys
Calls to /chat/completions, /embeddings and /images carry an API key as a bearer token. Keys start with sk-eva-. You create keys in your Evanesca account once the service opens; the full key shows once, when you create it, and after that only its first characters. Make one key per app or environment, so that revoking one stops nothing else.
Authorization: Bearer $EVANESCA_API_KEYKeep keys on the server — in an environment variable (the examples read EVANESCA_API_KEY) or a secret manager — never in front-end code or a public repository. If a key leaks, revoke it in your account: it stops working at once.
Which calls need a key
| Endpoint | What it does | Key |
|---|---|---|
POST/chat/completions | Runs a chat model; streaming supported. | Required |
POST/messages | The same chat models in Anthropic's Messages format; streaming supported. | Required |
POST/messages/count_tokens | Estimates, for free, the input tokens of a Messages request. | Required |
GET/models | Lists the catalogue: chat, embedding and image models. | None |
GET/models/{model} | Returns one model — what models.retrieve() calls in the OpenAI SDKs. | None |
POST/embeddings | Turns text into vectors. | Required |
POST/images/generations | Generates images from a text prompt. | Required |
POST/images/edits | Generates portraits from 1 to 4 face photos. | Required |
The catalogue answers without a key — even with a mistyped one — so a 200 on GET /models does not prove your key works. The real test is a chat call (first request).
A refused key
No key, a malformed key or a revoked one: the call gets 401 invalid_api_key. A valid key on an account whose credit is at zero gets 402 insufficient_credit (every error).
The OAuth 2.1 connector
ChatGPT and Claude do not take a key in a header: they connect to the MCP server with OAuth 2.1. You sign in to your Evanesca account and approve what the connector may do; no key is copied anywhere. An API key carries every right; a connector carries only the ones you approved.
| Right | What it allows | Tools |
|---|---|---|
inference | Run models on your behalf — chat completions and embeddings, billed to your credit like any API call. | chat_completion and create_embedding |
web | Search and read web pages, billed per call. | web_search and web_fetch |
account:read | See the account's name, e-mail address and credit balance. | check_balance and get_profile |
An access token lasts 1 hour; the client renews it with a refresh token that lasts 60 days and is replaced at each use. Tokens are opaque, Evanesca keeps only their hash, and they work only on the MCP endpoint, not on the REST API. The connection appears among your API keys as “<client> (OAuth)”: revoke it there to cut it off.
For client developers: PKCE with S256, the resource parameter (RFC 8707), discovery at https://evanesca.app/.well-known/oauth-protected-resource — the details are on the MCP page, after Claude's and OpenAI's connector guides read on 13 Oct 2026.