> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sinarcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create, copy, rename, and revoke the API keys your applications use to call the SinarCloud AI API, and try a key with the quick start.

API keys let your applications call the SinarCloud AI API. Every request carries a key, and SinarCloud charges the request to your balance or, if you have them for that model, to your [token credits](https://docs.sinarcloud.com/ai/token-credits.md). You can see your AI spending on [Usage and spending](https://docs.sinarcloud.com/ai/usage.md). You create and manage keys in the console: in the sidebar, under **AI**, click **API keys**.

The **API Keys** page has two parts: a quick start with the API endpoint and a sample request, and below it, **Your API keys**.

![The API Keys page. The quick start shows the API endpoint field with a copy icon and a Create API key button, the hint with the base URL, and a Quick start (cURL) sample request for deepseek/deepseek-v4-1-flash with its own copy icon. Below it, the Your API keys list has Refresh and Create API key buttons and an Active key with Copy, Rename and Revoke actions.](https://mintcdn.com/sinar-cloud/ShOrAB8ikH3IKe3Y/images/ai-api-keys.png?fit=max\&auto=format\&n=ShOrAB8ikH3IKe3Y\&q=85\&s=120f522a148d183a67e641d660a89697)

The API Keys page, with the quick start above your key list

## Your API keys

![The end of the Quick start (cURL) sample, followed by the Your API keys list with the number of keys, Refresh and Create API key buttons, and Key, Status, Created, Last used and Actions columns. Each key shows its name, the first characters of the key followed by dots, the scopes api:read and api:write, No expiry, the Active status, and Copy, Rename and Revoke actions.](https://mintcdn.com/sinar-cloud/ShOrAB8ikH3IKe3Y/images/ai-api-keys-list.png?fit=max\&auto=format\&n=ShOrAB8ikH3IKe3Y\&q=85\&s=485f41be9c2f3561f06d7acf80adde1d)

Your API keys, below the quick start

Each row in **Your API keys** shows:

* The key name and the first few characters of the key, followed by dots. The list never shows the full key.
* The key's scopes, `api:read` and `api:write`, separated by a dot. Every key you create in the console has both: `api:read` lets it list models, and `api:write` lets it send requests to models. You can't choose scopes in the console.
* **Expires** with a date, or **No expiry**.
* **Status**, **Created**, and **Last used**. A key that has never made a request shows **Never used**.

The list also keeps your revoked keys, so you have a record of them. If you don't have any keys yet, the list shows **No API keys yet** with a **Create API key** button. The list doesn't update by itself while the page is open. Click **Refresh** to reload it.

## Try the API with the quick start

The quick start at the top of the page helps you send a first request with a new key. It's always there, whether or not you have keys.

* **API endpoint** shows the full URL for chat completions requests. Click the copy icon next to it (**Copy endpoint**) to copy it. The hint under the endpoint shows the base URL. Use the base URL, `https://ai.sinarcloud.com/v1`, not the full endpoint, when you set up an OpenAI SDK or another API client.
* **Create API key**, beside **API endpoint**, opens the same dialog as the button above your key list. See [Create an API key](#create-an-api-key).
* **Quick start (cURL)** shows a sample cURL request for a chat model. Click the copy icon next to it (**Copy cURL**) to copy it.

To try a key with the sample:

**1. Copy the sample**

Under **Quick start (cURL)**, click the copy icon.

**2. Add your key**

Paste the request into a text editor and replace `YOUR_API_KEY` with one of your keys. To call a different model, replace the model alias in the request with one from the [model catalog](https://docs.sinarcloud.com/ai/models.md).

**3. Run it**

Run the request in a terminal. The response contains the model's reply.

> [!NOTE]
>
> The sample sends a real model request, so it's charged like any other request. If it fails with HTTP `404` and the error code `model_not_found`, the model in the sample isn't available. Replace its alias with one from the [model catalog](https://docs.sinarcloud.com/ai/models.md) and try again.

## Create an API key

**1. Open the create dialog**

On the **API Keys** page, click **Create API key**. There's one beside **API endpoint** in the quick start and one above your key list.

**2. Name the key**

Enter a **Key name**, such as the app and environment that will use it. Names can be up to 120 characters, and you can change them later.

![The Create an API key dialog with a Key name field and an Expires at (optional) date and time field, with a time zone hint under it. Cancel and Create key buttons are at the bottom.](https://mintcdn.com/sinar-cloud/ShOrAB8ikH3IKe3Y/images/ai-api-key-create.png?fit=max\&auto=format\&n=ShOrAB8ikH3IKe3Y\&q=85\&s=5856c63de285ff4a1b440fae4c588b91)

The Create an API key dialog

**3. Set an expiry (optional)**

In **Expires at (optional)**, pick a date and time in the future. The time uses the time zone shown under the field, which is the **Time Zone** in your [account settings](https://docs.sinarcloud.com/account/settings.md). Leave the field empty to create a key that never expires.

**4. Copy the key**

Click **Create key**. The **Your key is ready** dialog shows the full key under **New secret key**. Click **Copy secret**, store the key somewhere safe, and then click **Done**.

If you close the dialog before copying, you can still copy the key later. See [Copy a key again](#copy-a-key-again).

> [!WARNING]
>
> Keep your key private. Anyone who has it can send requests that you pay for.

## Copy a key again

You can copy the full key of an **Active** key at any time. Click **Copy** on its row, and the console puts the key on your clipboard.

**Copy** is unavailable for expired and revoked keys. If a key shows **Create a new key to enable copying.**, the console can't retrieve that key. Create a new key and use it instead.

## Use your key

Your application sends the key in the `Authorization` header as a bearer token. Keep the key in an environment variable instead of in your code.

The base URL is `https://ai.sinarcloud.com/v1`.

> [!TIP]
>
> **Copy endpoint** on the **API Keys** page copies the full chat completions URL, not the base URL. OpenAI SDKs add `/chat/completions` themselves, so give them `https://ai.sinarcloud.com/v1`.

```bash theme={null}
export SINARCLOUD_API_KEY="paste-your-api-key"
```

Listing models is a quick way to check that a key works, and it isn't charged:

```bash cURL theme={null}
curl "https://ai.sinarcloud.com/v1/models" \
  -H "Authorization: Bearer $SINARCLOUD_API_KEY"
```

```python Python theme={null}
import os
from openai import OpenAI

client = OpenAI(
    base_url="https://ai.sinarcloud.com/v1",
    api_key=os.environ["SINARCLOUD_API_KEY"],
)

for model in client.models.list():
    print(model.id)
```

```javascript Node.js theme={null}
import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://ai.sinarcloud.com/v1",
  apiKey: process.env.SINARCLOUD_API_KEY,
});

const models = await client.models.list();
for (const model of models.data) console.log(model.id);
```

The Node.js example uses `import` and top-level `await`. Save it as `index.mjs`, or set `"type": "module"` in your `package.json`.

To send model requests, see [Send requests](https://docs.sinarcloud.com/ai/requests.md). In the [Playground](https://docs.sinarcloud.com/ai/playground.md), you choose one of your active keys, and its requests are billed like any other request.

## Rename a key

Click **Rename** on the key's row, edit the **Key name**, and click **Save name**. Renaming changes only the label. The key itself stays the same, so your applications keep working.

## Revoke a key

Click **Revoke** on the key's row. In the **Revoke this API key?** dialog, click **Revoke key**, or click **Keep key** to cancel.

Revoking takes effect immediately. SinarCloud checks the key on every request, so the next request that uses it fails with HTTP `401` and the error code `invalid_api_key`. You can't undo a revocation. The key stays in your list with the status **Revoked**, and you can't copy it again.

## Key status

| Status | What it means | Actions available |
| - | - | - |
| **Active** | The key can make requests, unless its row says **This API key is still being provisioned.** | **Copy**, **Rename**, **Revoke** |
| **Expired** | The expiry time has passed. Requests with the key fail. | **Rename**, **Revoke** |
| **Revoked** | The key was revoked, by you or automatically after a failed creation. Requests with the key fail. | **Rename** |

You can't change a key's expiry after you create it. To keep access past the expiry, create a new key before the old one expires.

## Replace a key

To replace a key without downtime:

1. Create a new key and copy it.
2. Update your application to use the new key.
3. Click **Refresh** and check that **Last used** on the new key shows a recent time. The time can lag by up to a minute. A recent time shows that your application is sending the new key, not that every request succeeds.
4. Revoke the old key.

## Best practices

* **Use a separate key for each application or environment.** You can then revoke one key without affecting the others.
* **Keep keys out of source code.** Load them from environment variables or a secrets manager, and never commit them to a repository.
* **Call the API from your server.** Don't put keys in browser or mobile app code, where anyone can read them.
* **Set an expiry on temporary keys**, such as keys for tests or short projects.
* **Revoke keys you no longer use.** A key that shows **Never used** or an old **Last used** time is a good candidate.
* **If a key leaks, revoke it right away** and create a new one.

## Troubleshooting

> [accordion] Requests fail with 401 and invalid\_api\_key
>
> Check the key's status on the **API Keys** page. Expired and revoked keys can't make requests. Also check that the request sends exactly one `Authorization` header in the form `Bearer` followed by a space and the key, with no extra spaces or line breaks copied along with the key. If you're running the quick-start sample, check that you replaced `YOUR_API_KEY` with your key. If the key is **Active** and the header is correct, [contact support](https://docs.sinarcloud.com/help/support.md).

> [accordion] A key says it is still being provisioned
>
> If a key's row says **This API key is still being provisioned.**, the key can't make requests. Requests with it fail with HTTP `503` and the error code `key_provisioning_pending`, and the key doesn't appear in the Playground's **API key** list. The key won't become usable by itself. Create a new key and use it instead. The pending key may change to **Revoked** later, and you can ignore it. If new keys also show this message, [contact support](https://docs.sinarcloud.com/help/support.md).

> [accordion] Creating a key fails
>
> The dialog shows **Unable to create API key** with the reason. Try again. A failed attempt can leave an entry with the status **Revoked** in your list. That entry can't make requests, and you can ignore it. To mark it, click **Rename** and give it a name such as `failed - ignore`.

> [accordion] The key list doesn't load
>
> If the page shows **Unable to load API keys**, click **Try again**. If it shows a **Sign in** button instead, your session has ended. Sign in again, and the console brings you back to the **API Keys** page.

> [accordion] The Copy button doesn't work
>
> If the console shows **Copy failed**, click **Refresh** and check that the key is still **Active**. If it is, allow clipboard access for the console in your browser and try again. If a copy icon in the quick start shows **Copy failed** or a warning icon, allow clipboard access and try again.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.