Authentication
How Kontinent API keys work.
Every data-plane request authenticates with a bearer token:
Authorization: Bearer sk-kt-<43 base62 chars>
Key facts
- Keys are 49 characters total (
sk-kt-plus 43 base62 characters). - A key is shown exactly once at creation. Only a SHA-256 hash is stored. Kontinent cannot recover a lost key, so store it securely.
- A key can carry an expiry date. Without one it stays valid until you revoke it. Revoking and disabling take effect within about 30 seconds (the auth cache TTL). Expiry, including the end of a rotation grace period, takes effect within about 5 minutes.
- Every request is scoped to the key's organization, which owns the credit balance and usage attribution. The rate limit is set per key (default 60 requests per minute, see Rate limits & credits).
Treat a sk-kt- key like a password. Anyone holding it can spend your organization's credits. Prefer environment variables or a secrets manager over committing keys to source control.
Key lifecycle
You manage keys under API Keys in the console. Members manage the keys they created; owners and admins manage every key in the organization (see Team & roles).
| Action | What happens |
|---|---|
| Create | Name the key and optionally set an expiry date and a spend limit per day, week or month. The secret is shown once. |
| Expire | From the expiry date on, the key returns 401 invalid_api_key. Everyone in the organization gets an email 7 days before a key expires. |
| Rotate | Issues a new secret with the same name and limits. The old secret keeps working for 24 hours, so running deployments can switch over without an outage. The team assignment is not carried over: assign the new key to its team again. |
| Disable | Stops the key without deleting it. Requests return 401 until you enable it again. Useful when you suspect a leak but are not sure yet. |
| Revoke | Ends the key for good. It cannot be re-enabled. |
Each key has its own page with usage over time, so you can see what a single deployment costs. Every lifecycle action is written to the audit log.
Using the key
const client = new OpenAI({
baseURL: "https://api.kontinent.ai/v1",
apiKey: process.env.KONTINENT_API_KEY,
});client = OpenAI(
base_url="https://api.kontinent.ai/v1",
api_key=os.environ["KONTINENT_API_KEY"],
)curl https://api.kontinent.ai/v1/models \
-H "Authorization: Bearer $KONTINENT_API_KEY"When authentication fails
A bad or revoked key returns 401 with code invalid_api_key. Do not retry. The outcome will not change until you supply a valid key.
| Status | code | What it means |
|---|---|---|
401 | invalid_api_key | Bad, revoked, disabled or expired key. Fix the credential; retrying won't help. |
402 | insufficient_credits | The key is valid, but the organization's balance is exhausted. |
502 | upstream_auth_error | A provider rejected our credentials, not yours. Our problem. |
After more than 20 failed authentications from one IP address in the current minute, further invalid keys from that address get 429 rate_limit_exceeded with Retry-After: 60 instead of 401. Valid keys are not affected.
See Handling errors for the full taxonomy.