Managing API Keys

What Is an API Key?

An API key is a unique, secret token that authenticates your identity and authorizes your requests when you communicate with the Skytells API. Every interaction with the platform — whether through the REST API, an official SDK, the Playground, or a third-party integration — requires a valid API key linked to your Skytells account.

Your API key serves two critical purposes:

• Identification — It tells the platform which account is making the request, so usage and billing are attributed correctly.
• Authorization — It determines what resources you can access based on your account's plan and permissions.

API Key Format

Skytells API keys are prefixed strings that look like this:

sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The sk- prefix helps you quickly identify Skytells keys in your environment. The remainder is a cryptographically random string — never attempt to construct or guess a key.

Managing API Keys

Where to Find the API Keys

The API Keys page is located in the SkytellsDashboard under the API Keys section.

Creating a New API Key

In the API Keys page, you can create a new API key by clicking the Generate New API Key button. You will be prompted to enter a name for your new API key. This name will be used to identify the API key in the dashboard. Once you have entered a name, click the Generate API Key button to create the new API key. The new API key will be displayed on the page. You can copy the API key by clicking the Copy button.

Managing Existing Keys

From the API Keys dashboard you can:

• View key metadata — name, creation date, and the timestamp of the last request made with that key.
• Revoke a key — Immediately invalidate a key. Any request using a revoked key will receive a 401 Unauthorized error. This action cannot be undone.
• Create additional keys — There is no hard limit on the number of keys you can create. Use this to separate concerns across environments and services.

API Key Security

Your API key is equivalent to a password. Anyone who has it can make requests on your behalf — and you will be billed for that usage. Follow these principles to keep your keys safe:

• Each API key is tied to your account — all usage, including costs, is attributed to you.
• Revoke keys immediately if you suspect they've been exposed. You can do this from Dashboard → API Keys.
• The platform tracks last usage of every key. Review this regularly to spot unexpected activity.
• Use separate keys per environment — one for development, one for staging, one for production. If a dev key leaks, your production systems remain unaffected.
• Rotate keys periodically — even without a suspected breach, periodic rotation limits the window of exposure.

Best Practices

What to Do If a Key Is Compromised

Storing Your API Key

The recommended way to use your API key is through environment variables. This keeps the secret out of your codebase entirely.

Setting the Environment Variable

export SKYTELLS_API_KEY="sk-your-api-key-here"

Using It in Code

import { createClient } from 'skytells';

const client = createClient(process.env.SKYTELLS_API_KEY);

Production Secrets Management

For production deployments, consider using a dedicated secrets manager instead of plain .env files:

Using Your API Key in Requests

Pass the API key in the x-api-key header with every request:

curl https://api.skytells.ai/v1/predictions \
  -H "x-api-key: sk-your-api-key-here"

import { createClient } from 'skytells';

const client = createClient(process.env.SKYTELLS_API_KEY);

// The SDK attaches the x-api-key header automatically
const models = await client.listModels();