API keys
Creating, using, and protecting Speko API keys.
Format
Speko API keys look like:
sk_speko_<43 characters of base64url>A key belongs to one organization and authorizes both product surfaces:
- Router — sent as
Authorization: Bearer sk_speko_...on every request torouter.speko.dev. - Gateway (managed mode) — set as
SPEKO_API_KEYin the sidecar's environment; the gateway uses it only to talk to the control plane, never to a provider.
Creating keys
Create and revoke keys in the dashboard's API keys page. Gateway key creation includes the Router stack composer, and organizations can create as many active keys as their environments and workloads require. The raw key is shown exactly once at creation time — Speko stores only a keyed hash (HMAC-SHA256) and cannot recover the value. Store it in your secrets manager immediately.
Keys can be revoked at any time; revocation takes effect immediately.
Handling rules
Never ship an sk_speko_ key to a browser, mobile app, or any other client you distribute. Keys are server-side credentials: anyone holding one can spend against your organization until you revoke it.
- Prefer one key per service or environment so you can revoke narrowly.
- The gateway accepts every secret as either
SPEKO_API_KEYorSPEKO_API_KEY_FILE(mutually exclusive) so you can mount keys from files instead of environment variables. - Speko never asks for your key over email or support channels.
What a key is not
A key does not select routes, models, or regions — that is done per request. It also carries no spending cap of its own; credit and concurrency limits apply at the organization level. See Billing.