Authentication

All requests are authenticated with an API key passed in the Authorization header as a Bearer token. Keys start with sk-bk- and belong to an organization. The x-api-key header is also accepted, but it is read only when the request has no Authorization header. An Authorization header that is not a Bearer token is rejected with 401, with no fallback to x-api-key.

Managing keys

Create, name, and revoke keys in the console → API keys. The full secret is shown only once at creation; afterwards only a masked value is displayed.

• Create a separate key per application or environment (prod, staging, local).
• Revoke a key as soon as it may have leaked. Revocation is immediate.
• Rotate keys periodically; there is no limit on how many you can hold.

Organizations and projects

Each key is scoped to an organization and a project. Usage and credit consumption are attributed to that organization, so billing and rate limits apply per organization. Switch the active organization in the console to manage its keys and credits. Roles, invites, projects, key limits, budgets and credits are covered on Organizations & budgets.

If a request is rejected, see Errors for the 401/403 status codes and their meaning.