API keys and sign-in FAQ

What is the difference between an inference key and an Admin key?

Inference keys (sk_live_...) call models and use files, batches and agents. Admin keys (sk_admin_...) manage the organization through /v1/organizations/* and cannot call models. Each is refused where the other belongs, with 403 admin_key_required or 403 inference_not_allowed.

Can I use one key for several applications?

You can, but separate keys per application (or per environment) let you see usage per system, rotate one without touching the others, and revoke one quickly if it leaks.

My key leaked. What do I do first?

Revoke it in the Console immediately, create a replacement, and check the audit feed and usage for calls you do not recognise. Revocation is effective within seconds.

Who owns a key when the creator leaves?

Keys owned by a member stop working when the member is removed (org_membership_required). Use a service account for anything that must outlive one person’s employment.

Can my CI system authenticate without storing a key?

Yes, with workload identity: the job trades the token its CI platform issues for a Syntic token that expires within the hour.

Can I call the API directly from a browser?

Not with a secret key. Use a server-side proxy, or an OAuth app so each person signs in with their own account. See Call from a browser.