API Keys

An API Key is your credential for accessing Sakrylle. Every client, script, and SDK uses the same key for authentication — it is money, and anyone who has it can spend your balance.

Creating a Key

1. Log in to the Console at https://ai1.sakrylle.com
2. Left menu → API Keys
3. Click New Key
4. In the dialog, fill in:
   • Name (required): pick a name that lets you identify the purpose at a glance, such as cherry-studio-mac, server-prod, or temp-test
   • Expiration (optional): leaving it blank means never expires; even for long-term keys we recommend setting a 1-year expiry and rotating
   • Optional limits (if any): for example call count caps or per-call spending limits, configure as needed
5. After submission, the key string is shown only once at creation time and must be copied immediately. After you close the dialog there is no way to view the full key again

If you forget to save it, there is no recovery — you have to delete the old key and create a new one.

Viewing and Managing

The API Keys list page shows for each key:

• Name, creation time, expiration time
• Cumulative request count, cumulative spend (￥)
• Status (enabled / disabled / expired)

Clicking a key's details shows finer-grained usage statistics, including breakdowns by model and by date.

Deleting a Key

Click Delete on the corresponding row in the list and confirm; it takes effect immediately. After deletion, requests using that key will receive 401 invalid_api_key right away.

Deletion is irreversible and does not refund any cost already incurred by that key.

Using in Clients

Authentication is the same across all clients — pass the key as Authorization: Bearer <KEY> (or in the client's "API Key" field) to Sakrylle. See Client Integrations for how each client expects it.

In code:

curl https://api.sakrylle.com/v1/chat/completions \
  -H "Authorization: Bearer $SAKRYLLE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-5.6-sol","messages":[{"role":"user","content":"hi"}]}'

Security Recommendations

A leaked API Key is a real-money loss. Please follow these rules:

• Do not commit to Git: use environment variables (SAKRYLLE_API_KEY, OPENAI_API_KEY, etc.) or a .env file, and add .env to .gitignore
• Do not embed in frontend code: anything running in the browser can be inspected via DevTools by anyone. Frontend calls must go through your own backend proxy
• Do not post in chat groups, issues, or screenshots: even a partial leak should make you delete the old key immediately
• One key per place: create separate keys for each client and each environment (dev / prod) so you can pinpoint and revoke when something goes wrong
• Rotate regularly: rotate every 3-6 months; for high-sensitivity scenarios set a short expiration
• Limit scope: if the Console allows it, set daily / monthly spending caps to limit damage

If a Key Is Leaked

1. Immediately go to Console → API Keys and delete the key
2. Check the recent call history on the key's detail page to confirm whether there is anomalous spending
3. Replace it with a newly created key in every client / service that used the old one
4. If there is significant anomalous spending, email support@sakrylle.com with the details

Costs caused by key leaks are borne by the user according to the Usage Policy, so when you discover a leak, deleting the key first is more important than chasing accountability.