Authentication
Secret and publishable keys.
Every request carries an API key. There are two kinds:
| Key | Prefix | Use it | Can do |
|---|---|---|---|
| Secret | sk_live_ |
On your server only | Everything: chat, knowledge, tools, conversations |
| Publishable | pk_live_ |
In the browser (website widget) | Only the widget endpoints, optionally locked to your domains |
Send secret keys as a bearer token:
curl https://aiagent1.skotechlabs.com/api/v1/usage \
-H "Authorization: Bearer sk_live_your_key"
Never put a secret key in front-end code, a mobile app bundle or a public repository. If one leaks, revoke it in the dashboard — it stops working immediately.
Keys are stored as a one-way hash, so we can never show a key again after it is created. Lost it? Create a new one and revoke the old one.