Skip to Content
API AccessAuthentication

Authentication

API Access requests use Bearer token authentication with a Steinkauz API key.

API keys belong to the active context when you create them. Keys created in an organization are organization resources; revoke them when an integration is retired or a member leaves.

API key format

Keys look like:

sk-steinkauz-live-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  • The prefix sk-steinkauz-live- identifies production keys.
  • The full secret is shown once when you create the key in Settings → API Keys.
  • We store only a hash of the key; we cannot recover a lost secret.

Request header

Authorization: Bearer sk-steinkauz-live-YOUR_SECRET

Example

curl -sS "$STEINKAUZ_BASE_URL/v1/models" \
  -H "Authorization: Bearer $STEINKAUZ_API_KEY"

Store credentials in environment variables on the server that runs your integration (never commit real keys):

export STEINKAUZ_API_KEY="sk-steinkauz-live-..."
export STEINKAUZ_BASE_URL="https://chat.steinkauz.ai"

Key hygiene

  • Treat API keys like passwords. Do not embed them in client-side code or public repositories.
  • Use server-to-server calls. API keys are not intended for browser-exposed applications.
  • Prefer one key per integration or environment; revoke keys you no longer use.
  • Rotate keys if a secret may have leaked; revoke compromised keys immediately in Settings → API Keys.
  • Choose inherit Budget mode (default) to debit your user Budgets, or dedicated to give the key its own caps from the org API allocation.
  • Choose the lowest Provider environment floor that still meets your data needs.

Access requirements

Your active context must have a valid subscription and you must have a billable seat (in an organization) to use inference:

  • Gateway — Budgets on your Individual plan or org seat (System Gateway pool); API keys may inherit or use dedicated caps
  • BYOK — at least one configured provider with a valid API key in that context; optional Steinkauz Budgets (no row = uncapped)

Requests authenticated with a valid API key are authorized independently of the web chat session but still respect entitlements and seat status.

In organizations, only owners and admins can create API keys. See Members, roles & invites.

Last updated on
OverviewModels