xKiroxKiro docs

Authentication

Every request that runs a model needs an API key. Two header styles are accepted so both SDK families work unchanged.

Sending your key#

Use either header. They are equivalent — pick whichever your client already sends, which is usually decided for you by the SDK you chose.

OpenAI style
Authorization: Bearer sk-xt-your-key-here
Anthropic style
x-api-key: sk-xt-your-key-here
Complete request
curl https://api.xkiro.com/v1/chat/completions \
  -H "Authorization: Bearer $XKIRO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "openai/gpt-5.6-sol",
    "messages": [{ "role": "user", "content": "Hello" }]
  }'

Managing keys#

Keys are created on the API Keys page. A few properties are worth knowing:

  • The full key is displayed once. xKiro stores only a hash, so a lost key cannot be recovered — create a new one and delete the old.
  • Keys can be revoked at any time. Revocation takes effect within about a minute across all servers.
  • Each key can carry its own monthly spending limit, which is useful for separating staging from production or capping a single integration.
  • Usage is attributed per key, so a separate key per service makes your usage breakdown readable.

Treat a key like a password

Anyone holding it can spend your balance. Keep keys in environment variables or a secret manager, never in source control, and never in code that ships to a browser or mobile app. If a key leaks, revoke it first and investigate afterwards.

Endpoints that do not need a key#

Two endpoints are public so a client can browse what is available before anyone signs up:

  • GET /v1/models — the model catalog.
  • GET /v1/audio/voices — the voice catalog for text to speech.

Every endpoint that runs a model requires a valid key.

Authentication errors#

Missing key

401 Unauthorized
{
  "error": {
    "message": "Missing ClientApiKey. Send \"Authorization: Bearer <key>\" or the \"x-api-key\" header.",
    "type": "authentication_error",
    "code": "authentication_error"
  }
}

Invalid or revoked key

401 Unauthorized
{
  "error": {
    "message": "Invalid API key.",
    "type": "authentication_error",
    "code": "authentication_error"
  }
}

Requests to /v1/messagesreceive the same failures in Anthropic's error shape. Both are described in full on Errors.