Authentication

Every request to https://api.kyvalt.com/v1 needs a Kyvalt API key, including GET /v1/models.

Sending the key

Send the key in either header. Both work on every endpoint, so the OpenAI and Anthropic SDKs need no changes beyond the base URL.

If you send both headers they must carry the same key; two different keys return 400 invalid_request. A missing, unknown or revoked key returns 401 authentication_failed. The response is the same in all three cases, so it does not reveal whether a key ever existed.

Managing keys

• Create as many keys as you need in API keys, for example one per app or environment. The full key is shown only once, when you create it.
• Each key can carry its own minimum discount. Requests made with that key only go to offers at least that far below list price. See Discount floor and price cap.
• Revoking a key takes effect on the next request. Requests already running finish normally.
• All keys on an account draw from the same balance, and their requests appear together in Usage logs.

Keeping keys safe

• Call Kyvalt from your server. A key placed in a browser or mobile app can be read by anyone who uses it.
• Load the key from an environment variable or a secret manager rather than committing it to source control.
• If a key leaks, revoke it and create a new one. Usage logs show every request the old key made.