SHVYDKO / API
Keys and authentication
Organization API keys for your server, one-time secret display, and access revocation.
Creating a key
An owner or admin opens API Keys in the relevant organization and gives the key a clear name, such as support-staging. The secret is displayed once. The list retains the name and prefix for identification.
A key belongs to an organization: its balance, limits, and Usage apply to all its keys. Selecting another organization in your account does not transfer an existing key.
Sending the key
Call the API from a trusted server. Do not put the secret in public NEXT_PUBLIC_ variables or localStorage. For a browser application, create your own server endpoint with user authentication.
External /v1 endpoints use a Bearer key. The account's session cookie and active-organization header are not required for /v1 integration.
Authorization: Bearer <SHVYDKO_API_KEY>Rotation and revocation
A revoked, unknown, or missing key returns HTTP 401. Do not log Authorization or include it in a support request about an error.
- Create a new key and update the secret in your server environment.
- Test a GET /v1/models request with the new key.
- Revoke the old key in your account.
- If a key leaks, revoke it immediately; its full value cannot be retrieved again.