API Key Governance

Manage programmatic access to Sweetnight AIX services with scoped, revocable API credentials.

Key Lifecycle

┌────────────────────────────────────────────────────────┐
│                   API Key Security Model               │
├────────────────────────────────────────────────────────┤
│ • Cryptographically hashed (SHA-256) at rest           │
│ • Scoped by tenant, environment, and permission gates │
│ • Per-key rate limiting and budget quotas              │
│ • Automatic rotation and expiration alerts             │
└────────────────────────────────────────────────────────┘

Generating an API Key

1. Navigate to Developer → API Keys (/dashboard/settings/api-keys).
2. Click Generate New Key.
3. Choose a descriptive name (e.g., ci-agent-runner or production-backend-svc).
4. Select the environment: Production, Staging, or Development.
5. Define explicit permission scopes:
   • agent:read — Query agent metadata and configuration
   • agent:execute — Invoke agent runs and stream inference
   • mcp:invoke — Call MCP tools directly
   • models:read — List accessible model endpoints
6. Set an optional expiration window (30 days, 90 days, or never).
7. Copy your secret key immediately (aix_live_...). For security, the raw key is never displayed again.

Authentication in Code

Provide your API key in the Authorization header as a Bearer token:

cURL

curl -X POST https://aix.snnc.cc/api/v1/chat/completions \
  -H "Authorization: Bearer aix_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "qwen3-72b",
    "messages": [{"role": "user", "content": "Analyze quarterly trends"}]
  }'

Python (Agent SDK)

from agent_sdk import Client
 
client = Client(api_key="aix_live_xxxxxxxxxxxxxxxxxxxx")
response = client.agents.run(
    agent_id="ag_merchandising_analyst",
    query="Analyze Q3 inventory turnover"
)
print(response.output)

Quotas and Rate Limiting

Each API key is governed by your organization’s subscription tier:

• Requests Per Minute (RPM): Default 120 RPM, burstable up to 600 RPM.
• Tokens Per Minute (TPM): Monitored in real-time under Usage & Billing.
• Exceeding thresholds returns an HTTP 429 Too Many Requests status with standard Retry-After headers.