Skip to Content
API AccessAuthentication

Authentication

API Access requests use Bearer token authentication with a Steinkauz AI API key.

API keys belong to the active organization when you create them. Keys created in an organization are organization resources; revoke them when an integration is retired or a member leaves.

API key format

Keys look like:

sk-steinkauz-live-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  • The prefix sk-steinkauz-live- identifies production keys.
  • The full secret is shown once when you create the key in API access.
  • We store only a hash of the key; we cannot recover a lost secret.

Request header

Authorization: Bearer sk-steinkauz-live-YOUR_SECRET

Example

curl -sS "$STEINKAUZ_BASE_URL/v1/models" \
  -H "Authorization: Bearer $STEINKAUZ_API_KEY"

Store credentials in environment variables on the server that runs your integration (never commit real keys):

export STEINKAUZ_API_KEY="sk-steinkauz-live-..."
export STEINKAUZ_BASE_URL="https://platform.steinkauz.ai"

Key hygiene

  • Treat API keys like passwords. Do not embed them in client-side code or public repositories.
  • Use server-to-server calls. API keys are not intended for browser-exposed applications.
  • Prefer one key per integration or environment; revoke keys you no longer use.
  • Rotate keys if a secret may have leaked; revoke compromised keys immediately in API access.
  • Under Usage attribution, choose Inherit (default) to count requests towards your personal usage limits, or Dedicated to give the key separate optional cost and token limits.
  • Choose the API routing policy that matches the data that integration will send.

Access requirements

Steinkauz Cloud requires an active subscription for your organization. Private deployments without subscription billing do not require a Cloud subscription.

  • BYOK / customer-owned Gateway: at least one configured connection in the organization, with credentials where the provider requires them. Steinkauz AI usage limits are optional; no usage limit applies until you configure one.

Requests authenticated with a valid API key are authorized independently of the browser login session but still respect entitlements and membership.

Members can create keys that count towards their personal usage limits. Only owners and admins can create keys with separate usage limits. See Members, roles & invites.

Configuration Audit

Creating a key, revoking it, or changing its usage attribution mode appears in Change history. The log stores the key prefix only, never the secret. See Configuration Audit.

OverviewModels