Authentication

Every request carries a bearer token:

Authorization: Bearer ep_live_…

There is no other way in. A request without the header is refused with 401.

Where keys come from

Create them at pirol.ai/console under API keys. The key is shown once, at creation. We store only a hash of it, so a lost key cannot be recovered — create a new one and revoke the old.

Revoking takes effect immediately. The next request with that key is refused.

Which pot a key draws on

A workspace can have two sources of money at once, and the key decides which one pays:

A Kyte subscription does not pay for a console key. If your console credit is empty, a running Kyte subscription will not cover it, and the other way round.

401 or 402

The two are kept apart on purpose, so a billing problem is never mistaken for a broken key.

401 — the key is missing, unknown or revoked. Check what you sent.

402 — the key is fine, the money is not. The message says which pot and what to do:

{
  "error": {
    "message": "this month's credits are used up (€19.95) — manage your plan at https://pirol.ai/console/billing"
  }
}

Nothing is retried into existence here: wait, top up, or change the plan.

Keys in your code

Read the key from the environment, never from source. The endpoint is the only thing that should ever see it, and a key in a repository is a key in everyone's hands.