API Keys (Reference)

Last Updated: 2026-02-04
Content-Type: Reference
Audience: Developers

---

Formats accepted

Kirakira accepts API keys in either format:

• Authorization: Bearer <api_key>
• X-API-Key: <api_key>

Key properties

• Prefix: first 12 characters, used for lookup and display (keyPrefix)
• Hash: bcrypt hash stored in DB (keyHash)
• Scopes: list of permissions (scopes[])
• One-time secret reveal: secret is stored encrypted until revealed once

Scopes

Common scopes:

• kirakira:models → GET /v1/models
• kirakira:chat → POST /v1/chat/completions

User endpoints

Base path: /api/user

• POST /api/user/api-key-requests
• GET /api/user/api-key-requests
• GET /api/user/api-keys
• POST /api/user/api-keys/:id/reveal
• POST /api/user/api-keys/:id/revoke

Admin endpoints

Base path: /api/admin

• GET /api/admin/api-key-requests
• POST /api/admin/api-key-requests/:id/issue
• POST /api/admin/api-key-requests/:id/reject
• GET /api/admin/api-keys
• PUT /api/admin/api-keys/:id
• POST /api/admin/api-keys/:id/revoke
• POST /api/admin/api-keys/:id/rotate