API keys
Creating a key
Go to Keys → New key, give it a name (name it after the machine or tool that will use it — "work-laptop", "ci"), solve the captcha, done. Keys look like:
sk-og-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
The key is shown exactly once
We store only a one-way hash, so the full key cannot be displayed again — ever. Copy it into your tool (or a password manager) right away. Lost it? Just revoke and create a new one; keys are free and unlimited.
Using a key
Send it in either standard header — both are accepted on every endpoint:
HTTP
Authorization: Bearer sk-og-... # — or — x-api-key: sk-og-...
For per-tool wiring (Claude Code, Cursor, Cline, …) see the setup guides in the sidebar; for raw API usage see endpoints & auth.
Revoking a key
On the Keys page, hit Revoke next to the key. Takes effect immediately — the next request with that key gets 401 {"error": "invalid_api_key"}. Revoking never touches your balance; it only kills the credential.
Key hygiene
- One key per machine or tool. When a laptop is lost or a key leaks, you revoke just that key without re-configuring everything else.
- Keep keys out of git. Put them in
~/.claude/settings.json, env vars, or a secrets manager — never in committed code. If a key lands in a public repo, treat it as leaked and revoke it. - Leaked key = revoke first, investigate second. A stolen key spends your balance. Check Transactions for charges you don't recognize.