API troubleshooting

Fix hosted API errors without sharing secrets.

Use safe checks for generated keys, billing state, quotas, rate limits, and server availability before changing your tool or opening a support request.

Open account Recover API key API reference Check status Read quickstart Request one-subscription beta Support paths

Create an account now. Connect an authorized provider or add billing when you are ready to route.

Hosted model traffic uses https://api.tekiz.ai/v1, generated sk_tekiz_* keys, and route profiles such as tekizai/frontier.

Before support

Do not paste prompts or credentials.

  • Do not paste prompts, workflow text, customer data, provider responses, or private business context.
  • Do not paste provider credentials, OAuth tokens, generated API keys, private keys, session cookies, or raw Authorization headers.
  • Safe context is limited to timestamp, HTTP status, safe error class, route profile, plan, request id if present, and the non-secret key prefix only.
Endpoint

Check base URL

Use https://api.tekiz.ai/v1 for hosted OpenAI-compatible clients. Browser account UI lives on https://app.tekiz.ai, not the API host.

Key

Check prefix

Hosted model traffic requires an active generated sk_tekiz_* key. Full keys are shown once and should never be pasted into support.

Route

Check profile

Start with tekizai/frontier. Use the public model catalog for discovery, but remember live /v1/models is authenticated.

Status What it means Useful response signals Next action
401 The key is missing, revoked, inactive, malformed, or not a TEKIZ.AI generated key. WWW-Authenticate, JSON accountUrl, accountSetupUrl, primaryActionUrl, managedAccessUrl, keyRecoveryUrl, pricingUrl, statusUrl, openaiBaseUrl, apiKeyPrefix, placeholder setupSnippet, and placeholder codexSetupSnippet. Confirm the client sends Authorization: Bearer sk_tekiz_..., open accountSetupUrl or primaryActionUrl to create an API key, use keyRecoveryUrl if the signup needs same-email recovery, use managedAccessUrl only for review-only one-subscription interest, copy setupSnippet or codexSetupSnippet only after replacing the placeholder key, then test /v1/models from the account page, curl, or codex --profile tekizai-frontier.
402 The account cannot route because payment is incomplete, the plan is inactive, or the quota is used up. X-Quota-Limit, X-Quota-Used, X-Quota-Remaining, X-Quota-Period, and account or pricing links in the JSON body. Finish checkout, check current usage, upgrade the plan, or wait for the quota period to reset. Contact support if a manual payment has already been confirmed.
429 The request-per-minute limit or abuse control was reached. Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, and quota headers. Reduce concurrency, retry after the indicated delay, batch less aggressively, or upgrade to a plan with a higher rate limit.
403 / 1010 Cloudflare blocked the HTTP client fingerprint before the request reached TEKIZ.AI. JSON body with error_code: 1010 or browser_signature_banned; no X-TEKIZAI-Router-* headers. Use the OpenAI SDK, curl, or set a normal User-Agent for raw urllib-style clients; then retry /v1/models.
503 No healthy authorized backend route is currently available. Status page health, selected upstream, backend health checks, and any safe request id or route profile name. Check public status, verify local/Tailnet router health if using a private install, and retry after failover or backend recovery.

Safe probes

Check the response headers, then send one short request.

If raw Python urllib gets Cloudflare 403 / 1010, use a normal client User-Agent so the request reaches the TEKIZ.AI auth gate. 

curl -i https://api.tekiz.ai/v1/models \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "User-Agent: OpenAI-compatible-client/1.0"

curl -i https://api.tekiz.ai/v1/chat/completions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "User-Agent: OpenAI-compatible-client/1.0" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "tekizai/frontier",
    "messages": [{"role": "user", "content": "Return ok."}]
  }'

Python urllib

Check authentication from a plain Python client.

Until you add a generated key, this check should return TEKIZ.AI Router's 401 until you replace the placeholder with a generated sk_tekiz_* key. It should not return Cloudflare 1010. 

import urllib.error
import urllib.request

req = urllib.request.Request(
    "https://api.tekiz.ai/v1/models",
    headers={
        "Authorization": "Bearer sk_tekiz_REPLACE_WITH_GENERATED_KEY",
        "User-Agent": "OpenAI-compatible-client/1.0",
        "Accept": "application/json",
    },
)

try:
    with urllib.request.urlopen(req, timeout=15) as response:
        print(response.status, response.read().decode("utf-8", errors="replace"))
except urllib.error.HTTPError as exc:
    print(exc.code, exc.read().decode("utf-8", errors="replace"))

401 setup snippet

Start with a placeholder, then add your key.

Replace only the placeholder key after the account page creates your generated sk_tekiz_* key. Keep real bearer tokens out of support threads and screenshots. 

# TEKIZ.AI hosted setup
export OPENAI_BASE_URL=https://api.tekiz.ai/v1
export OPENAI_API_KEY=sk_tekiz_REPLACE_WITH_GENERATED_KEY

curl "$OPENAI_BASE_URL/models" \
  -H "Authorization: Bearer $OPENAI_API_KEY"

Codex 401 profile

Use the hosted frontier profile after key setup.

A 401 response also includes codexProfile and a placeholder codexSetupSnippet. Use them to restore Codex or OpenClaw without guessing the provider, profile, model, or API type.

Codex setup guide 
# TEKIZ.AI hosted Codex setup
export TEKIZAI_API_KEY=sk_tekiz_REPLACE_WITH_GENERATED_KEY
mkdir -p ~/.codex
# Add this provider block once to ~/.codex/config.toml.
cat >> ~/.codex/config.toml <<'TOML'
[model_providers.tekizai]
name = "TEKIZ.AI Hosted"
base_url = "https://api.tekiz.ai/v1/"
env_key = "TEKIZAI_API_KEY"
wire_api = "responses"
TOML

# Create ~/.codex/tekizai-frontier.config.toml.
cat > ~/.codex/tekizai-frontier.config.toml <<'TOML'
model_provider = "tekizai"
model = "tekizai/frontier"
TOML

# Plain codex keeps using ChatGPT. TEKIZ.AI is explicit.
codex --profile tekizai-frontier

What to send support

Share error details, not private data.

  • Keep HTTP status, timestamp with timezone, route profile, plan, and whether the same key passes the account-page API key test.
  • Keep non-secret headers such as WWW-Authenticate, Retry-After, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-Quota-Limit, X-Quota-Used, X-Quota-Remaining, and X-Quota-Period.
  • Keep JSON onboarding links such as accountUrl, accountSetupUrl, primaryActionUrl, managedAccessUrl, keyRecoveryUrl, pricingUrl, statusUrl, openaiBaseUrl, the non-secret apiKeyPrefix, and placeholder setupSnippet / codexSetupSnippet. Remove full bearer tokens and prompt bodies.

Provider access

Use only provider access you are allowed to use.

Hosted plans provide account management, API keys, usage limits, request history, and automatic fallback. They do not bypass provider rules, combine personal accounts, or grant access without permission. Managed access is available only for providers and plans that TEKIZ.AI has approved and listed.

Request one-subscription beta