Skip to main content
Kyara Intelligence authenticates every request with an API key that you send as a bearer token in the Authorization header. There are no sessions or cookies. Each request is authenticated on its own, so keeping your key secret is essential.

​
Get your key

Create and manage your API keys in the Kyara dashboard. When you generate a new key, it is shown to you only once, so copy it immediately and store it somewhere secure such as a password manager or a secrets vault. If you ever need to rotate a key, you can regenerate it from the dashboard at any time. Regenerating a key immediately revokes the old one, so update any services using it before you rotate.

​
Send the token

Pass your API key in the Authorization header as a bearer token on every request. The value must be the string Bearer followed by your key.
If you’re using the OpenAI JavaScript or Python SDK, you don’t need to set the header manually. The SDK does it for you when you supply your key through the apiKey parameter:
Never hard-code your API key in client-side code or commit it to a repository. Always read it from a server-side environment variable named KYARA_INTELLIGENCE_API_KEY. Exposed keys can be used by anyone to run requests at your expense.

​
Let users bring their own key

If you’re building an application for other people, use the hosted onboarding flow instead of collecting keys manually. Send users to:
Kyara guides the user through creating their own API key, shows it to them once, and then sends them back to your app through the redirect URL. The key is not appended to the redirect, so the user copies it and pastes it into your app to finish connecting. This keeps your users in control of their own credentials. See the onboarding API reference for full details on the redirect parameter and the flow.

​
Error reference

If you receive a 401, check that your Authorization header is formatted as Bearer <key> and that the key has not been regenerated or deleted in the dashboard.