Authentication
Bearer authentication with sk-ct- keys: creation, budget caps, revocation, and how metering attributes spend per key.
Bearer keys
Authenticate every request with an Authorization header. Keys are created in the dashboard, shown once at creation, and start with sk-ct-.
Authorization: Bearer sk-ct-…Per-key budget caps
Each key can carry a budget cap set from the dashboard. When a key's metered spend reaches its cap, calls fail with a structured error instead of accumulating surprise spend — the recommended setup for agents and CI.
Revocation
Revoke a key from the dashboard at any time. Treat revocation as propagation, not an instant kill: allow up to five minutes for a revoked key to stop validating everywhere.
Attribution
Usage is metered per key, so one key per agent, service, or teammate gives you cost per consumer as a dashboard filter instead of a spreadsheet.