Authentication for the tabular foundation model

Informational documentation. This section explains how a tabular foundation model of the Data Language Model class works: what goes in, what comes out, and how results are evaluated. It is based on the paper Data Language Models: A New Foundation Model Class for Tabular Data (arXiv:2605.06290). It is reference material, not a hosted service: hosts such as api.example.com, keys, and ids are placeholders.

Every API request carries an org-scoped API key as a bearer token:

http

Authorization: Bearer <API key>

Keys are created on the platform's API page or with POST /v2/keys. The secret is shown once, at creation, and never again; listings show the key id (key_...) and a preview of the secret. Store secrets in a secrets manager and rotate with POST /v2/keys/:id/rotate.

Two modes, one org

Mode	Who	How
Interactive	Humans	Web sign-in on the platform
Headless	CI, agents, pipelines, apps	`Authorization: Bearer $API_KEY`

An endpoint created over the API appears in the platform Endpoints list immediately.

Scopes

Outputs are bundled, so keys are never scoped per output. They are scoped by operation:

Scope	Allows
`read`	List and get endpoints, data, reports, jobs, usage, models, keys
`run`	Stateless inference on the base models: `POST /v2/run`
`serve`	Call live endpoints: `POST /v2/serve/:id`
`manage`	Create endpoints, refresh, upgrade, connect and sync data, pin and unpin, generate synthetic data, cancel jobs, manage keys
`delete`	Delete endpoints and data, revoke keys

A key can hold any combination. Give production systems the least they need: a pipeline that only serves endpoints needs serve alone.

Errors

Situation	Response
Missing or malformed key	`401` `auth_error`
Key revoked	`401` `auth_error`
Key lacks the route's scope	`403` `auth_error`

See the error envelope for the envelope.

What a key covers

Connection credentials you register are encrypted at rest and write-only.