API Key Format
Chuizi.AI API keys are the primary authentication mechanism for all API requests. Each key is tied to a user account and can be individually configured with access controls, rate limits, and usage restrictions.
Key Format
| Property | Value |
|---|---|
| Prefix | ck- |
| Body | 32 alphanumeric characters (a-z, A-Z, 0-9) |
| Total length | 35 characters |
| Example | ck-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx |
The ck- prefix identifies Chuizi.AI keys and allows tools to distinguish them from other API keys. The prefix is always lowercase.
Security Properties
Storage
API keys are never stored in plaintext. The gateway stores a securely encrypted hash of the full key. The ck- prefix and first four characters of the body (e.g., ck-a1B2) are stored separately as a human-readable identifier.
| Stored | Value | Purpose |
|---|---|---|
key_hash | Securely encrypted hash of full key | Authentication lookup |
key_prefix | ck-a1B2 | Display in dashboard, support queries |
Display Policy
The full API key is shown exactly once at creation time. After you dismiss the creation dialog, the full key is not retrievable. If you lose a key, delete it and create a new one.
Authentication Flow
- Client sends
Authorization: Bearer ck-xxxxx(orx-api-key: ck-xxxxx). - Gateway computes the secure hash of the key.
- Gateway looks up the hash in the authentication system.
- If found and active, the request proceeds. If not, returns
401.
Key Management
Manage your API keys at app.chuizi.ai under the API Keys section.
Create a Key
- Navigate to API Keys in the console sidebar.
- Click Create Key.
- Enter a name (e.g., "Production Server", "Claude Code").
- Optionally configure access controls (see below).
- Click Create.
- Copy the displayed key immediately. You will not see it again.
Delete a Key
Deleting a key is immediate and irreversible. All requests using that key will begin returning 401 invalid_api_key.
List Keys
The dashboard shows all keys with their prefix, name, group, status, and creation date. Use the GET /v1/key/info endpoint to query key details programmatically.
Next Steps
- API Key Best Practices — Secure storage, rotation, and leak response procedures
- Sign Up — Create an account and generate your first key
- Error Codes — Troubleshoot 401 and 403 authentication errors