Managing keys

Mint and revoke sk-hyd- API keys and register machines for the Claude proxy, using your account master token.

The AI Gateway uses three credential types. This page covers how to obtain and manage them programmatically. All endpoints here live at ai.hep.gg and are authenticated with your master token.

The three credentials#

Your account#

Send Authorization: Bearer hyd_.... Returns { user: { id, name, email }, machines: [...] }.

API keys#

A key is pinned to one model at creation, so list the available slugs first. qwen3-8b is generally available; cf-gpt-oss-20b is admin only. See Usage and quotas for plan access and the per-account allowance.

curl -X POST https://ai.hep.gg/keys \
  -H "Authorization: Bearer hyd_..." \
  -H "Content-Type: application/json" \
  -d '{"name":"my-script","model":"cf-gpt-oss-20b"}'

const res = await fetch("https://ai.hep.gg/keys", {
  method: "POST",
  headers: {
    Authorization: "Bearer hyd_...",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ name: "my-script", model: "cf-gpt-oss-20b" }),
});
const { key } = await res.json(); // sk-hyd-... shown once

The response contains the full key (sk-hyd-...) exactly once, plus a short prefix. The secret is hashed at rest, so store it now; afterwards only the prefix is retrievable.

Returns keys[] with id, name, model_slug, key_prefix, request_count, prompt_tokens, completion_tokens, last_used_at, disabled, and created_at.

Returns { "ok": true }. You can only delete keys you own.

Registering a machine (for the Claude proxy)#

Returns { id, proxy_token }. The proxy_token (pt_...) goes in the path of the Claude proxy. In practice the ccas CLI registers the machine and wires the proxy token for you, so you rarely call this by hand.