Authentication

A workspace API key authenticates the REST API. It looks like sk_live_ followed by a long random string, it belongs to a workspace rather than to you personally, and anything it does is billed to that workspace’s credits.

Prefix

sk_live_

Who can mint one

The workspace owner. Nobody else can create, list or revoke keys — not even to view them masked.

Requirement

The workspace must have spent at least $100 in credits, lifetime, before its owner can mint a first key.

Shown

Once, at creation. Eddie stores a hash, never the plaintext — a lost key cannot be recovered, only revoked and replaced.

1. Open the workspace menu and choose Integrations.
2. Find the API keys section.
3. Click Create key and give it a label.
4. Copy the plaintext secret shown. It will not be shown again.

Set it as an environment variable and the CLI reads it automatically:

export EDDIE_API_KEY=sk_live_…

Calling the SDK directly, pass it to the constructor rather than relying on the environment:

import { Eddie } from "@eddieai/cli/dist/sdk.js";
const eddie = new Eddie({ apiKey: "sk_live_…" });

Every request carries it as a bearer token. You do not construct this header yourself — the CLI and SDK both add it — but it is what is on the wire:

Authorization: Bearer sk_live_…

The SDK exchanges the key for a short-lived token once (cached until shortly before it expires) and uses that token, rather than the raw key, for the calls that need it. This happens inside the client; a reader of these pages never has to manage the exchange themselves.

Revoke a key from the same API keys section a moment after you suspect it leaked — a key pasted into a shared script, committed to a repository, or printed to a log you did not expect to be public. A revoked key stops authenticating on its next use; nothing else about the workspace changes.

• Revoking is not spend-gated. It works regardless of the workspace’s current balance.
• There is no way to see a key’s plaintext again after creation, revoked or not. Mint a new one and update whatever used the old one.

• No API key. The CLI and SDK both throw immediately, before making a request, if EDDIE_API_KEY is unset and no key was passed explicitly.
• 401 on every call, right after creating the key. Confirm you copied the whole string, including the sk_live_ prefix, with no surrounding whitespace.
• 403 minting a key, or the button is disabled. Either you are not the workspace owner, or the workspace has not yet spent $100 in credits. The refusal body names which.
• 401 after a key that used to work. The key was revoked. Mint a new one.

Failures that arrive after authentication succeeds are covered in Errors and limits.