API Keys

Application API keys allow external services to authenticate with the public Optiak Gateway API for one application.

These are different from provider keys:

• Application API keys are created inside an application and are used by your services to call Optiak.
• Provider keys are created in Company Setup -> Models and let Optiak call upstream providers such as OpenAI, Anthropic, AWS Bedrock, Google Gemini API, and Vertex AI.

Creating an API Key

1. Open Applications
2. Select the application that should receive traffic
3. Open Credentials
4. Click New Key
5. Provide a descriptive name
6. Optionally add a label and description
7. Choose an expiration preset
8. Copy the generated key immediately

Expiration presets include:

• No expiration
• 7 days
• 30 days
• 90 days
• 1 year

The full key is only shown once. After creation, Optiak only displays the key prefix.

Using an API Key

Send the key as a bearer token:

export OPTIAK_BASE_URL="https://api.optiak.dev/v1"
export OPTIAK_API_KEY="your_application_api_key"

curl "$OPTIAK_BASE_URL/chat/completions" \
  -H "Authorization: Bearer $OPTIAK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "smart",
    "messages": [
      { "role": "user", "content": "Hello" }
    ]
  }'

Each key is tied to the application where it was created. Requests authenticated with that key use that application's models, modules, guardrails, enrichment settings, cost settings, and inference defaults.

Use GET /models with the same key to confirm which public model IDs are available before sending production traffic.

Security Recommendations

• Never share your API keys in public repositories
• Rotate keys periodically
• Use one key per integration to enable granular revocation
• Use expirations for temporary tests or short-lived integrations
• Store keys in a secret manager or environment variable
• Revoke keys immediately when an integration is retired or compromised

Revoking a Key

To revoke an API key, open the application's Credentials tab and use the delete control next to the key.

Once revoked, any service using that key loses access immediately.