Authentication & Authorization — Getting Started

Last Updated: 2026-02-04
Content-Type: Tutorials
Audience: Developers

What to use when

Portal / first-party clients: JWT (Authorization: Bearer <jwt>)
External clients / integrations: API key (Authorization: Bearer <api_key> or X-API-Key: <api_key>)

Kirakira uses DB-backed API keys with these properties:

User requests a key (Portal → Profile → API Keys)
Admin issues the key (Portal → Admin → API Keys)
User can reveal the secret once, then it is not recoverable
Keys have scopes (permissions), such as kirakira:chat and kirakira:models

If you want maximum compatibility with ChatGPT-like interfaces and OpenAI SDKs, use the /v1/* endpoints:

See: