> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kyara-intelligence.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Kyara Intelligence uses API keys. Create a key, pass it as a Bearer token, and keep your credentials secure.

Kyara Intelligence authenticates every request with an API key that you send as a bearer token in the `Authorization` header. There are no sessions or cookies. Each request is authenticated on its own, so keeping your key secret is essential.

## Get your key

Create and manage your API keys in the [Kyara dashboard](https://kyara-intelligence.com/dashboard). When you generate a new key, it is shown to you **only once**, so copy it immediately and store it somewhere secure such as a password manager or a secrets vault.

If you ever need to rotate a key, you can regenerate it from the dashboard at any time. Regenerating a key immediately revokes the old one, so update any services using it before you rotate.

## Send the token

Pass your API key in the `Authorization` header as a bearer token on every request. The value must be the string `Bearer ` followed by your key.

```bash theme={null}
curl https://api.kyara-intelligence.com/v1/chat/completions \
  -H "Authorization: Bearer $KYARA_INTELLIGENCE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "deepseek/deepseek-v4-flash",
    "messages": [
      { "role": "user", "content": "Hello!" }
    ]
  }'
```

If you're using the OpenAI JavaScript or Python SDK, you don't need to set the header manually. The SDK does it for you when you supply your key through the `apiKey` parameter:

```javascript theme={null}
const client = new OpenAI({
  baseURL: "https://api.kyara-intelligence.com/v1",
  apiKey: process.env.KYARA_INTELLIGENCE_API_KEY, // SDK sets the Authorization header for you
});
```

<Warning>
  Never hard-code your API key in client-side code or commit it to a repository. Always read it from a server-side environment variable named `KYARA_INTELLIGENCE_API_KEY`. Exposed keys can be used by anyone to run requests at your expense.
</Warning>

## Let users bring their own key

If you're building an application for other people, use the hosted onboarding flow instead of collecting keys manually. Send users to:

```text theme={null}
https://api.kyara-intelligence.com/onboard?redirect=<your-redirect-url>
```

Kyara guides the user through creating their own API key, shows it to them once, and then sends them back to your app through the `redirect` URL. The key is not appended to the redirect, so the user copies it and pastes it into your app to finish connecting. This keeps your users in control of their own credentials. See the [onboarding API reference](/api/onboarding) for full details on the redirect parameter and the flow.

## Error reference

| HTTP status | Error code             | Cause                                                   |
| ----------- | ---------------------- | ------------------------------------------------------- |
| `401`       | `authentication_error` | The API key is missing, malformed, or has been revoked. |

If you receive a `401`, check that your `Authorization` header is formatted as `Bearer <key>` and that the key has not been regenerated or deleted in the dashboard.