API Keys & Auth

SeedofCode AI uses API keys for authentication. You must include your API key in the Authorization or x-api-key HTTP header of every request you make to the inference endpoints.

API Key Format

All production SeedofCode AI API keys begin with the prefix soc_live_.

soc_live_your_api_key_here

[!TIP] The soc_live_ prefix helps you easily identify SeedofCode AI keys in your codebase and prevents them from being confused with keys from other providers. It also enables secret-scanning tools (like GitHub Advanced Security) to automatically detect leaked keys.

Making Authenticated Requests

You can authenticate your requests by passing the key in one of three ways:

  1. As a Bearer token in the Authorization header (Standard).
  2. As an api_key token in the Authorization header.
  3. In the x-api-key header.

Example 1: Authorization Header (Bearer)

Because your API key natively begins with soc_live_, you can safely use the standard Bearer scheme without confusing it for a JWT.

POST /api/chat HTTP/1.1
Host: api.ai.seedofcode.dev
Authorization: Bearer soc_live_your_api_key_here
Content-Type: application/json

Example 2: Authorization Header (api_key)

POST /api/chat HTTP/1.1
Host: api.ai.seedofcode.dev
Authorization: api_key soc_live_your_api_key_here
Content-Type: application/json

Example 3: x-api-key Header

POST /api/chat HTTP/1.1
Host: api.ai.seedofcode.dev
x-api-key: soc_live_your_api_key_here
Content-Type: application/json

Example: OpenAI SDK

The OpenAI SDK automatically formats the header for you when you pass the apiKey configuration option. By default, it sends it as a Bearer token!

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://api.ai.seedofcode.dev/api",
  apiKey: "soc_live_your_api_key_here", // Typically loaded from process.env
});

Managing Your Keys

You can manage your API keys in the Developer Console under API Keys.

  • Create: Generate a new key at any time.
  • Revoke/Delete: If a key is compromised, you can delete it immediately. It will be instantly rejected by the API Gateway.
  • Visibility: For security, you can only view a key in plaintext once, immediately after creating it. If you lose it, you must generate a new one.

Security Best Practices

  • Never expose your keys in frontend code. If you need to make API calls from a browser or mobile app, route them through your own backend server that securely holds the soc_live_ key.
  • Use environment variables. Store your keys in .env files and never commit them to git.
  • Rotate keys periodically. Create a new key, update your servers to use it, and then delete the old key.