API keys
Each project gets two credentials: an always-visible API key that identifies it, and a secret, shown once, that authenticates its servers.
Credential types
| Credential | Prefixes | Visible | Purpose |
|---|---|---|---|
| API key | zyneo_key_test_zyneo_key_live_ | Always | Identifies the project (X-Zyneo-Key) |
| Secret | zyneo_sk_test_zyneo_sk_live_ | Once, at creation | Authenticates the server (Authorization: Bearer) |
The secret is displayed exactly once. Copy it into your secret manager when it is created. If it is lost, issue a new pair — there is no recovery.
Test vs live
| Test | Live | |
|---|---|---|
| Prefix | _test_ | _live_ |
| Data | Sandbox users and sessions | Real end users |
| Network | localhost allowed | Allowlisted origins / server IPs only |
Issuing a pair
POST /v1/projects writes the tenant, project, and hashed secret to
D1. The first call bootstraps an empty database. Later calls require a valid
existing pair. The plaintext secret is never stored and never returned again.
How secrets are stored
- Only a SHA-256 hash of the secret is stored — never the plaintext.
- A short display prefix is kept so you can recognize the key later.
- Verification uses constant-time comparison against the stored hash.
Rotation
- Issue a new key + secret pair from your project settings.
- Deploy the new secret to your servers.
- The old secret keeps a short grace window, then stops working.
Next step
Make your first call with the Quickstart.