Authentication

Create an API key in your Spavik workspace and store it in your application's secret manager. Use that key for the REST API, Python SDK, TypeScript SDK or MCP.

Connect with your API keyCopy Anchor Link

Your integration uses an API key, which starts with sk-spv-api-. Workspace admin keys, which start with sk-spv-admin-, manage the workspace and cannot train or predict. Set SPAVIK_API_KEY as shown in Get started. Both SDKs read it and send X-Spavik-Api-Key. SPAVIK_BASE_URL is an optional SDK override; the default is https://api.spavik.co. The cURL examples use this variable to construct their request URLs. The examples below list the models accessible to that key.

from spavik import Spavik

spavik = Spavik()
for model in spavik.models():
    print(model.id)

An explicitly empty key disables the environment fallback, for example Spavik(api_key="") in Python or new Spavik({ apiKey: '' }) in JavaScript: the client then sends no key rather than reading SPAVIK_API_KEY. The API checks permissions and quotas for the operation you request.

For the MCP server, configure the same X-Spavik-Api-Key header in your client.

Keep keys out of your codeCopy Anchor Link

Store the secret when it is created: it is shown only once. Do not commit it, include it in browser code or print it in logs. Load it from an environment variable or secret manager at runtime.

When replacing a key, update your deployed callers and verify access before retiring the previous key. Manage keys and account settings in your workspace; your integration only needs the key used for its API calls.

When a call is refusedCopy Anchor Link

A permission refusal is different from insufficient credits or a model quota: use the returned error code to decide what to change. See Error codes.