Treza API keys authenticate programmatic access to the platform: calling a published pipeline and using the AI Gateway. A key looks like treza_live_..., is scoped to your account, and is sent as a bearer token.
In the dashboard, open the API keys page and create a key.
The key (treza_live_...) is shown once, at creation. Store it in a secrets manager immediately. If you lose it, revoke it and create a new one.
Send the key in the Authorization header as a bearer token on every request:
Authorization: Bearer treza_live_...For example, invoking a published pipeline:
curl https://trezalabs.com/api/pipelines/<id>/invoke \
-H "Authorization: Bearer treza_live_..." \
-H "Content-Type: application/json" \
-d '{ "inputs": { "brief": "A 6-second product demo" } }'The same key works with the OpenAI-compatible endpoint. Point any OpenAI SDK at your pipeline and pass the key as the api_key. See the Pipeline API.
Account-scoped. A key can only act on resources owned by the same account. In particular, a key can only invoke pipelines your account owns; calls to another account's pipeline return 403.
Published only. Pipeline endpoints serve the published snapshot. An unpublished pipeline returns 409.
Credits. Calls that run a pipeline draw from your account's prepaid credit balance. If the balance is empty, requests return 402.
Keys carry scoped permissions that gate access per feature. Grant only the scopes a key needs.
redact:proxy
OpenAI-compatible redacting chat completions (the AI Gateway)
redact:run
Standalone text redaction
redact:log
Read the redaction audit log
pii:ingest, pii:read, pii:write, pii:delete, pii:consent, pii:audit
PII vault operations
Invoking a published pipeline requires a valid key that owns the pipeline; the gateway and PII endpoints additionally require the scopes above.
Revoke a key from the API keys page the moment you suspect it is exposed.
Rotate keys periodically: create a new key, move your integrations over, then delete the old one.
Never embed a key in client-side code or a public repository. Call Treza from your backend, where the key stays secret.
Pipeline API - call a published pipeline with your key.
Build your first pipeline - end-to-end, including creating a key.
AI Gateway - redaction proxy that uses redact:* scopes.
Last updated