Authentication

You're Claude Code, working in my repository.

Task
Make this project authenticate to Meta Model API the safe way: read the key from the MODEL_API_KEY environment variable (never hard-coded), send it as Authorization: Bearer on every request, pass it explicitly to any SDK client, and stop with a clear message when it's missing. If browser or mobile code calls the API, move those calls behind a server route that adds the key, so the key never reaches the client.

Read this first
Meta's docs page "Authentication" as Markdown: https://dev.meta.ai/docs/authentication.md
It's the source of truth for request and response shapes. The same page for people: https://dev.meta.ai/docs/authentication

Setup
- Base URL: https://api.meta.ai/v1
- Auth: send Authorization: Bearer $MODEL_API_KEY, reading MODEL_API_KEY from the environment. Never hard-code, print or commit the key.
- Model: muse-spark-1.3-contributor (Contributor mode: Meta may use what you send to train future models; drop -contributor for Standard mode)
- Python: the OpenAI SDK (pip install openai) with base_url="https://api.meta.ai/v1" and api_key=os.environ["MODEL_API_KEY"] works, or plain requests.

Facts to get right
- Keys look like LLM_{numeric id}_{secret} and are shown once, when created in the Model API dashboard (API keys, Create API key).
- The header is Authorization: Bearer $MODEL_API_KEY. The OpenAI SDK reads OPENAI_API_KEY and the Anthropic SDK ANTHROPIC_API_KEY, not MODEL_API_KEY: pass it when you create the client (Anthropic: auth_token, with base_url https://api.meta.ai).
- A missing, malformed, revoked or mistyped key returns 401 with type authentication_error and code invalid_api_key.
- Keys on one team share its rate limits. Rotate by creating a new key, moving apps to it, then deleting the old one.
- Keep credential files such as .env out of git (.gitignore), and use one key per app or developer.

Starter code (Python)
import os
import sys

import requests

api_key = os.environ.get("MODEL_API_KEY")
if not api_key:
    sys.exit("Set MODEL_API_KEY to your Model API key first.")

response = requests.post(
    "https://api.meta.ai/v1/chat/completions",
    headers={"Authorization": f"Bearer {api_key}"},
    json={"model": "muse-spark-1.3-contributor", "messages": [{"role": "user", "content": "Hello"}]},
)
if response.status_code == 401:
    sys.exit("The API refused the key (invalid_api_key): check MODEL_API_KEY against the dashboard.")
response.raise_for_status()
print(response.json()["choices"][0]["message"]["content"])

Done when
- A request with the key from the environment succeeds (GET /v1/models is a free check).
- With MODEL_API_KEY unset, the code stops with a clear message instead of sending a request without a key.
- No key or .env file is committed, and no client-side bundle contains the key.
- The key comes from MODEL_API_KEY and never appears in code, logs or commits.
- API errors (4xx, 429) surface their message instead of failing silently.