H2O Ai Authentication

generated: '2026-08-04'
method: searched
source: openapi/h2o-ai-h2ogpte-openapi-original.yml, openapi/h2o-ai-mlops-scoring-openapi-original.yml
docs: https://docs.h2o.ai/enterprise-h2ogpte/guide/apis
notes: >-
  Baseline derived mechanically with 0-working/derive-authentication.py, then upgraded from
  H2O.ai's own API-keys guide and the authorization section of the h2oGPTe OpenAPI info
  description (which documents the header format and the two key types the securityScheme
  does not express).
summary:
  types:
  - http
  http_schemes:
  - bearer
  api_key_in: []
  oauth2_flows: []
  oidc: false
  mutual_tls: false
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  description: Using an API key generated by H2OGPTe
  header: Authorization
  format: 'Authorization: Bearer sk-...'
  key_prefix: sk-
  applied: globally (top-level security on all 422 operations)
  sources:
  - openapi/h2o-ai-h2ogpte-openapi-original.yml
  key_types:
  - name: global
    created_when: no Collection is selected at key creation
    grants: >-
      Full user impersonation and system-wide access. Anyone holding the key can create,
      delete or interact with any of the user's past, current and future Collections,
      Documents, Chats and settings.
  - name: collection-specific
    created_when: a Collection is selected at key creation
    grants: >-
      Chat with the specified Collection and related API calls to it only. Cannot create or
      delete Collections, and cannot reach other Collections or Chats.
  creation_ui: Account Circle > Using the API > + New API Key
  revocation: >-
    Keys are deleted from the h2oGPTe UI and cannot be recovered. h2oGPTe 1.7.0 added
    automated API key deactivation as an enterprise governance feature.
  rotation_policy: not-published
  expiry: not-published
gaps:
- api: H2O MLOps Scoring REST API
  spec: openapi/h2o-ai-mlops-scoring-openapi-original.yml
  issue: >-
    The published specification declares no components.securitySchemes and no security
    requirement, yet every one of its seven operations declares a 401 response. The
    authentication mechanism for a deployed scoring endpoint is therefore not described by
    the contract and must be taken from the MLOps deployment configuration.
- api: Enterprise h2oGPTe REST API
  issue: >-
    The two key types are a real authorization model but are expressed only in prose. The
    specification carries one flat bearerAuth scheme with no scopes and no per-operation
    security differentiation, so a machine reader cannot tell which of the 422 operations a
    Collection-specific key may call.
related:
  oauth_scopes: none (no oauth2 securityScheme in either specification)
  platform_oidc: >-
    H2O AI Cloud platform sign-in and the h2o-authn / h2o-cloud-discovery Python clients use
    OIDC token exchange, but that is platform authentication and is not declared in either
    public REST contract.
  conventions: conventions/h2o-ai-conventions.yml