Authentication & Project Keys

Bearer authentication

Every public API request needs a Kryyt project key in the Authorization header. Project keys start with kryyt_.

Request header

Authorization: Bearer kryyt_your_project_key

Key lifecycle

1. Create a named project under API & developers.
2. Create a separate key for each service or environment.
3. Store the full key when it is issued; the account lists only its identifying prefix afterward.
4. Deploy a replacement key before revoking an old one.
5. Revoke exposed or unused keys immediately.

Requests fail authentication when the key is missing, invalid, revoked, or belongs to an inactive project. An OAuth sign-in session and a VS Code editor token are not substitutes for a project API key.

Safe storage

Use environment variables or your deployment platform's secret store. Do not place keys in public JavaScript, mobile bundles, HTML, URLs, repositories, screenshots, or logs. Calls from a website should go through your own backend.

Read a server secret

import os

api_key = os.environ["KRYYT_API_KEY"]

Project funding

Authentication does not imply sufficient balance. If the account cannot cover the estimated request, the API returns 429 with insufficient_credits. See error handling.