Manage API Keys

API keys are how Runars authenticates your requests. This guide covers key creation, usage, and lifecycle management.

Key basics

• Format: All Runars API keys start with sk-runars- and are 32 bytes of random data.
• Storage: Only a SHA-256 hash of your key is stored server-side. We never store the plaintext.
• Visibility: The full key is shown once at creation. Save it immediately—you cannot retrieve it later.
• Scope: Keys are tied to an organization. Team members in the same organization can use the same key, but keys don't cross organization boundaries.

Creating an API key

1. Log in to your Runars dashboard
2. Select your organization (or create a new one)
3. Go to Dashboard → API Keys
4. Click Create API Key
5. Enter a descriptive name (e.g., "Production" or "Claude Code (laptop)") to help you track its use
6. Click Create
7. Copy the key and save it securely — this is the only time you'll see it

Using an API key

Include your key in one of two ways:

Option 1: x-api-key header (recommended for Anthropic SDK and Claude Code)

curl https://api.runars.ca/v1/messages \
  -H "x-api-key: sk-runars-..." \
  -H "content-type: application/json" \
  -d '{ ... }'

Option 2: Authorization Bearer token (OpenAI SDK and Codex CLI)

curl https://api.runars.ca/v1/chat/completions \
  -H "Authorization: Bearer sk-runars-..." \
  -H "content-type: application/json" \
  -d '{ ... }'

Both forms are equivalent. Use whichever suits your tool.

Revoking a key

If a key is compromised or you no longer need it:

1. Go to Dashboard → API Keys
2. Find the key in the list (identified by its last 4 characters and name)
3. Click the Revoke button
4. Confirm the action

Revoked keys stop working immediately and cannot be re-enabled. A new request using a revoked key will receive a 401 Unauthorized response.

Security best practices

• Never hardcode keys: Use environment variables (e.g., RUNARS_API_KEY, ANTHROPIC_API_KEY, OPENAI_API_KEY).
• Rotate regularly: Create new keys and revoke old ones periodically.
• Track usage: Visit Dashboard → Logs to see which keys are being used and when.
• Minimal scope: Create separate keys for different environments (dev, staging, production) so compromising one key affects only that environment.

Monitoring key usage

Each key's last-used timestamp is displayed in the dashboard. Use this to identify unused keys that can be safely revoked.

For detailed request logs and usage by key, visit Dashboard → Logs.