Skip to main content
To protect the platform and your workloads, Novita AI is upgrading access authentication for the GPUs product line (Serverless and GPU Instance). Starting October 26, 2026 (UTC), requests that reach these services through Novita’s default domains must carry a valid API key, or originate from a whitelisted source IP. Unauthenticated public access will no longer be supported.

​
What changes

  • Serverless: Endpoint calls must include a valid API key. Unauthenticated requests return HTTP 401.
  • GPU Instance HTTP port mapping: Requests to instance HTTP services through *.gpu-instance.novita.ai must include a valid API key.
  • GPU Instance TCP port mapping: SSH, database, and other TCP services require a source IP whitelist. TCP port mapping is no longer open to the internet. If you use TCP port mapping, submit your whitelist before October 26, 2026.

​
How to adapt

Add a standard Bearer token header to every request, using your Novita API key:
The hosts stay the same as today. Callers only need the extra header. If you have shared your endpoint URL with third parties, or embedded it in frontend or mobile code, update those callers and redeploy. For TCP port mapping, submit your source IP whitelist through customer support.

​
Transition period

October 19 to October 26, 2026 is the transition period. Existing access methods keep working during this window. Please complete your changes as early as possible to avoid service interruption.
Last modified on October 20, 2026