API keys

API keys authenticate requests to the Cipher API. You create and manage them in Settings, then Connectors (or in the developer console).

Key types

Cipher keys come in two forms:

• Secret keys start with cipher_sk_. Use them only on a server. They can run every tier your plan allows and should never be exposed in client side code.
• Publishable keys start with cipher_pk_. Safe to use in the browser for lighter, client side validation.

A key looks like this:

cipher_sk_aB3dEf...   (49 characters after the prefix)

Creating a key

1. Open Settings, then Connectors.
2. Under API keys, give the key a name (for example, Production or Staging).
3. Click Create key and copy the value.

You can create multiple keys, name each one, disable a key temporarily, or revoke it permanently. Naming keys per environment or per service makes it easy to rotate or revoke one without affecting the others.

What a key controls

Each key carries:

• Tier limit. The highest Cipher tier the key may request. Asking for a higher tier returns a TIER_NOT_AVAILABLE error.
• Credits. Each validation spends one credit. When a key runs out you get an INSUFFICIENT_CREDITS error until it is topped up.
• Rate limit. The maximum requests per window for that key.

Authenticating

Send the key as a bearer token on every request:

curl https://api.surbee.com/api/cipher/validate \
  -H "Authorization: Bearer cipher_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "tier": 2, "thresholds": { "fail": 0.5, "review": 0.75 }, "input": { } }'

Responses include two helpful headers:

• X-Cipher-Request-Id for support and debugging.
• X-Cipher-Credits-Remaining so you can track usage.

Next: Cipher SDK and API.