Inference (data plane)
Cloud and Gateway inference routes accept only Authorization: Bearer <token>. Non-Bearer schemes return 401 invalid_api_key.
| Credential | Where created | Used for |
|---|---|---|
| Cloud API key (zk_…) | Cloud /app | GET/POST /api/v1/models, chat, responses |
| Gateway API key | Gateway admin / bootstrap env | Gateway /v1/* inference and MCP authorize |
Browser sessions
- Cloud customer dashboard uses a signed session cookie — not valid as an inference Bearer key.
- Cloud internal admin and Gateway /admin use separate admin session secrets.
- OIDC login establishes a customer session for governance UI; it does not replace API keys for /api/v1.
Enterprise extras
- License activation talks to the issuer with certificate material — not your inference API key.
- Managed policy sync uses a gateway sync token from activation — distinct from data-plane keys.
- Organization service-account keys (governance) are for enterprise access decisions, not a drop-in Cloud zk_ key.