Sylvester ML API

Authentication

Every request must include your API key in the api-key HTTP header:

api-key: YOUR_API_KEY
  • The header name is exactly api-key. It is not Authorization, and it is not a Bearer token.
  • A missing or incorrect key returns HTTP 401 (see the error formats for v2 and v1).
  • Always call the API over HTTPS.

The only paths that don't need a key are the public v2 documentation pages: /v2/docs, /v2/redoc, and /v2/openapi.json.

Keep your key secret

  • Call the API from your servers, not from mobile or browser apps. Anything shipped inside an app can be extracted. If your mobile or web app needs predictions, send the image to your own backend and call Sylvester from there.
  • Don't commit keys to source control. Load them from environment variables or a secrets manager.
  • If a key may have leaked, contact Sylvester to rotate it.