Get started

Keys and rules

How keys inherit the project's settings, and every rule a key can set.

Keys look like sx_ followed by 40 URL-safe characters. Scalaix keeps only a SHA-256 hash, so a key is shown once, when it's created. The console shows a prefix (sx_ab12cd) so you can tell keys apart.

Send the key as a bearer token on every request:

Authorization: Bearer sx_...

How rules combine

A project has settings (edit them under Settings → Gateway in the console) and each key has rules. Both have the same shape. For each field, the key's value wins when it's set (not null); otherwise the project's value applies; otherwise the built-in default.

{
  "allowed_models": [],
  "default_model": "gpt-4o-mini",
  "routing": { "mode": "fixed", "objective": "balanced", "candidates": [] },
  "fallback_models": [],
  "cache": { "enabled": false, "ttl_seconds": 3600 },
  "budget_usd_monthly": null,
  "rpm": null,
  "modes": ["gateway", "endpoints"],
  "collections": null,
  "allowed_origins": [],
  "allowed_ips": []
}

Fields

Field	Meaning	Default
`allowed_models`	Model ids the key may use. `[]` allows every catalog model.	all
`default_model`	Used when a request has no `model`, or sends `"default"`.	catalog default
`routing`	`mode` `fixed` or `auto`; `objective` `cost`, `latency` or `balanced`; `candidates` to choose among (`[]` = allowed models). See Routing and fallback.	fixed
`fallback_models`	Tried in order when the model fails, for gateway requests.	none
`cache`	`enabled` and `ttl_seconds` for gateway requests. See Caching.	off
`budget_usd_monthly`	Key only. Billed USD per calendar month (UTC). `null` = no limit.	none
`rpm`	Key only. Requests per minute.	none
`modes`	Key only. `gateway`, `endpoints`, or both.	both
`collections`	Key only. Collection slugs the key may call. `null` = all.	all
`allowed_origins`	Key only. Browser `Origin` values allowed to use the key. `[]` = any, and no CORS headers.	any
`allowed_ips`	Key only. CIDR ranges such as `203.0.113.0/24`. `[]` = any.	any

A key can also expire: set an expiry when you create it, and requests after that date get 401 invalid_api_key.

Keys in the browser

Keys are secrets. If you must call Scalaix from a browser, create a key with allowed_origins set to your site, modes set to endpoints, a short collections list, a low rpm and a budget. Requests from other origins get 403 forbidden.

Revoking a key

Revoke a key from the Keys page. It stops working within about 30 seconds (the gateway caches key lookups briefly) and can't be restored. Deleting a project revokes all of its keys.