Get an API key
OpenAI-compatible endpoint. Bring your own SDK.Buyers call Malibu at
https://api.malibu.tech/v1 with the OpenAI SDK. To get an API key, sign in to the console with GitHub:
Open the console
GitHub sign-in · No credit card
How keys are issued
- Open malibu.tech/console and choose Sign in with GitHub. Sign-in runs through
api.malibu.techand requests only theread:userGitHub scope, with no repository or organization access. - After sign-in, the console issues an API key. Keys start with
mp_. - The full key is shown once. Copy it immediately. Malibu stores only a hash and cannot show it again.
- Use the console’s API keys view to create a new key or revoke an old one. A revoked key returns
403 api_key_revoked.
First request
The set of models being served changes. This example uses a model that several providers served on 23 Sep 2026. Confirm withclient.models.list() first.
What the API surface covers
- Chat completions with streaming (
stream: true) and token-incremental deltas. - Multi-turn tool calling: first-turn emission, second-turn
role: "tool"acceptance, and assistant-history rendering. Validate tool calls before you execute them. See Buyer-side validation. - Structured output:
response_format: {"type": "json_schema", ...}with the OpenAI strict-mode subset. - Prompt-cache reuse: automatic for repeated scaffolds. Send
X-MacProvider-Conversationto prefer the same provider across turns; the cache-hit rate applies when that preference wins. See Sticky conversations. - Signed receipts: some non-streaming responses carry a v0.3 Ed25519-signed receipt in the
X-MacProvider-Receiptheader (currently roughly a quarter to a third); streams never do. For the rest, useGET /v1/receipts. Offline verification of current receipts is pending a verifier update. - Compatibility facades:
/v1/responsesand/v1/messages(Anthropic Messages) for clients that speak those APIs.
Model catalog
Models you can call right now (key required):client.models.list(). To check availability without a key, use GET https://api.malibu.tech/v1/stats/models. For listed vs priced vs catalog models, see Operations → Model catalog.
Quota and billing
Each account gets a daily token quota that resets at UTC midnight. TheX-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers on every chat response report it, and so does GET /v1/usage. When it runs out, requests return 429 quota_exhausted until the reset.
Usage is metered against the public rate card: