Getting Started

Authentication & Workspaces

How tokens, API keys, and workspace scoping work across the Console platform API and inference.

Two ways in

Your account, manage the platform with the CLI

Everything you manage, API keys, BYOK credentials, usage, billing, training, compute, is done with your Stimulir account through the CLI (or the console UI). stimulir login signs you in through a browser device authorization, no password is typed in the terminal, and stores your session in ~/.stimulir/. Login also selects your workspace, so every command after that is scoped to it automatically:

Manage the platform
stimulir login
stimulir keys list

Scripting? Every command takes --json to emit the raw API response, no need to call the platform API by hand.

Your apps, hyb_* API keys for inference

The inference endpoint is what your applications integrate against, and it authenticates with hyb_* API keys. Keys are created in the Engineering workspace and carry their own environment, limits, and expiry:

Inference request
curl https://api.stimulir.com/api/v1/inference/chat/completions \
  -H "Authorization: Bearer hyb_..." \
  -H "Content-Type: application/json" \
  -d '{"model": "qwen3-4b", "messages": [{"role": "user", "content": "Hi"}]}'

API keys are workspace-scoped. The plaintext key is returned once at creation, see API Keys for lifecycle management.

Workspaces

A workspace (business profile) is the unit of isolation: API keys, BYOK credentials, usage, billing, and training jobs all belong to a workspace. Users can be members of multiple workspaces.

bash
# Login already selects a workspace; these switch it if you have more than one
stimulir workspace list   # the active workspace is marked
stimulir workspace use <id>

When calling the platform API directly, pass the workspace explicitly with the X-Business-Profile-Id header on every request.