/docs/ai/keys-and-tokens

The AI Gateway uses three credential types. This page covers how to obtain and manage them programmatically. All endpoints here live at ai.hep.gg and are authenticated with your master token.

The three credentials#

Your account#

Send Authorization: Bearer hyd_.... Returns { user: { id, name, email }, machines: [...] }.

API keys#

A key serves one model, chosen at creation, so list the available slugs first. qwen3-8b is generally available; cf-gpt-oss-20b is admin only. See Usage and quotas for plan access and the per-account allowance.

If your plan offers more than one model, you can point an existing key at a different one later from the LLM Keys page in the dashboard. The secret, its prefix and its usage counters stay the same, so nothing in your client changes; the next request simply goes to the new model.

curl -X POST https://ai.hep.gg/keys \
  -H "Authorization: Bearer hyd_..." \
  -H "Content-Type: application/json" \
  -d '{"name":"my-script","model":"cf-gpt-oss-20b"}'

const res = await fetch("https://ai.hep.gg/keys", {
  method: "POST",
  headers: {
    Authorization: "Bearer hyd_...",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ name: "my-script", model: "cf-gpt-oss-20b" }),
});
const { key } = await res.json(); // sk-hyd-... shown once

The response contains the full key (sk-hyd-...) exactly once, plus a short prefix. The secret is hashed at rest, so store it now; afterwards only the prefix is retrievable.

Returns keys[] with id, name, model_slug, key_prefix, request_count, prompt_tokens, completion_tokens, last_used_at, disabled, and created_at.

Returns { "ok": true }. You can only delete keys you own.

Registering a machine (for the Claude proxy)#

Returns { id, proxy_token }. The proxy_token (pt_...) goes in the path of the Claude proxy. In practice the ccas CLI registers the machine and wires the proxy token for you, so you rarely call this by hand.