API keys and access
Create the right key for evaluation, telemetry, or CI without exposing credentials.
Create an application key
Select the intended organization in the dashboard, then open API Keys → Create API Key. Choose a name that identifies the application and environment. For SDK evaluation and OTLP export, use ingest scope.
The full value is shown at creation. Copy it to your deployment's secret store. Do not paste it into docs examples, source control, frontend environment variables, screenshots, or logs.
Scope boundaries
| Scope | Intended access |
|---|---|
ingest | Evaluation and supported ingestion; also accepted by explicitly API-key-readable read endpoints. |
test | CI submission and polling for saved Test Lab suites and connected-agent regressions. |
read | Read endpoints that explicitly support API keys; does not authorize evaluation or ingestion. |
full | All API-key capability groups; reserve for applications that actually need them. |
Keys belong to an organization. An ingest key is not restricted to one agent just because a client sets agent_name. Agent-specific policy scope is a separate setting. Dashboard management remains session- and role-controlled.
Configure the server
export NYRAXIS_API_KEY="your-issued-ingest-key"
export NYRAXIS_BASE_URL="https://api.nyraxis.io"Use the actual backend origin for self-hosted deployments. Never prefix the key with NEXT_PUBLIC_ or send it to a browser. The model provider's key is a separate credential.
Rotate a key
- Create a replacement with the required scope.
- Update the application's secret store and restart or reload its client configuration.
- Verify an evaluation and telemetry receipt from that application.
- Revoke the old key in the dashboard.
- Verify the revoked value is rejected. Remove it from active configuration.
Use separate development and production keys. Keep CI test keys separate from agent ingest keys. Revoking a key does not remove existing traces.
Diagnose access failures
A 401 can indicate a missing, invalid, or revoked key. A 403 can indicate insufficient scope. Confirm that you are contacting the backend attached to the organization in which the key was issued. Do not retry a denied operation with fail-open behavior.
Continue with the quickstart or evaluation API.