API keys

The inference endpoints (/v1/...) need a key unless you set SPARK_REQUIRE_API_KEY=false. The console and its API (/api/admin) use the console password and a session cookie instead.

Create a key

API keys → Create a key takes a name and a Zero retention switch. The key starts with sk-spark- and is shown once. Spark stores only its hash. Disable a key to refuse it without deleting it, and delete it when it is no longer used. The list shows each key's prefix, when it was created, when it was last used and how many requests it served.

Send a key

Either header works on every /v1 route, for both APIs:

Authorization: Bearer sk-spark-…
x-api-key: sk-spark-…

OpenAI SDKs send the first one. Anthropic SDKs send the second.

A key for scripts

SPARK_API_KEY adds one more accepted key, at least 16 characters. It needs no entry in the console. Its requests appear in the request log under the name SPARK_API_KEY.

When keys are not required

With SPARK_REQUIRE_API_KEY=false, a request with no key is accepted and logged as anonymous. A request that carries a wrong key is still refused with 401, because a client that sends a key expects it to be checked.

Zero retention

A key created with Zero retention on has its requests logged without their content. See Request log and zero retention. It is set when the key is created and cannot be changed.

Errors

The error body follows the API's own format: {"error": {"message", "type", ...}} on OpenAI routes, and {"type": "error", "error": {...}} on Anthropic routes.

CORS

Browsers may call /v1 directly. Spark answers preflight requests with Access-Control-Allow-Origin: *, and allows the Authorization, Content-Type, x-api-key, anthropic-version, anthropic-beta, OpenAI-Organization and OpenAI-Beta headers. CORS applies to keys, never to the console's cookies. Do not put a key into a web page that others can read.