Authentication
Bearer keys, budgets, revocation
All /api/v1/* calls need Authorization: Bearer sk-sonnely-....
Keys
Create keys in the console — one per app, teammate or environment. A key is shown once; only a hash is kept, so a lost key is replaced, never recovered.
- Budgets — cap what one key can spend. Checked before the request runs.
- Team scope — keys can draw from a shared team pool instead of personal balance.
- Revoke instantly — revoking stops the next request. Past usage stays on record.
Treat a key like a card number: environment variable, never a committed file. A script in a retry loop can burn a balance in minutes — set a budget.
Errors
| Status | Meaning |
|---|---|
| 401 | Missing or unknown key |
| 402 | Balance short — response names the credits needed |
| 429 | Rate limited — back off and retry |
Webhooks
Set a webhook URL on any key (console → key form) to receive JSON POSTs:
| Event | When |
|---|---|
insufficient_credits | A call was refused for low balance |
budget_exceeded | A call hit the key's budget cap |
low_balance | Balance dropped under 1,000 after a call |
Body: { event, key_prefix, ...details }. Respond fast; deliveries are
fire-and-forget with a 4s timeout.
Spend history
GET /api/v1/usage with your key returns its recent calls — models, tokens,
credits. No extra auth.
Account login
The playground, console and account pages use email + password login (sign in). Wallet connection is for funding; API keys are for calling.