API keys
Creating, using, and protecting Speko API keys.
Format
Speko API keys look like:
sk_speko_<43 characters of base64url>A key belongs to one organization and authorizes both product surfaces:
- Relay — sent as
Authorization: Bearer sk_speko_...on every request torelay.speko.dev. - Gateway (managed mode) — set as
SPEKO_API_KEYin the sidecar's environment; the gateway uses it only to talk to the control plane, never to a provider.
Creating keys
Create and revoke keys in the dashboard's Gateway keys page. Key creation takes a name; your organization can have up to 10 active keys. The raw key is shown exactly once at creation time — Speko stores only a keyed hash (HMAC-SHA256) and cannot recover the value. Store it in your secrets manager immediately.
Keys can be revoked at any time; revocation takes effect immediately.
Handling rules
Never ship an sk_speko_ key to a browser, mobile app, or any other client you distribute. Keys are server-side credentials: anyone holding one can spend against your organization until you revoke it.
- Prefer one key per service or environment so you can revoke narrowly.
- The gateway accepts every secret as either
SPEKO_API_KEYorSPEKO_API_KEY_FILE(mutually exclusive) so you can mount keys from files instead of environment variables. - Speko never asks for your key over email or support channels.
What a key is not
A key does not select routes, models, or regions — that is done per request. It also carries no spending cap of its own; credit and concurrency limits apply at the organization level. See Billing.