Keys & workspace

API keys

Zelyx uses two types of key: provider keys (your real OpenAI / Anthropic / Google secrets, stored encrypted in the vault) and Zelyx keys (what developers put in their code).

Provider keys

Provider keys are managed by workspace admins on the API Keys page under Provider keys. Developers never see or hold them.

Adding a provider key

1. Go to API Keys → Provider keys → Add key.
2. Select the provider or enter a custom slug.
3. Paste your API key. Zelyx infers the provider from the key prefix and rejects obvious mismatches (e.g. an Anthropic key submitted as OpenAI).
4. Optionally give it a label (e.g. anthropic-prod) and run an upstream validation call to confirm the key is active.
5. Click Save. The key is validated, encrypted (AES-256-GCM), and stored. The plaintext is never persisted.

Supported provider key formats

Revealing a key

Workspace admins can reveal the stored key prefix (first 8 characters) for identification. The full key cannot be recovered from the UI — if you need to rotate it, add the new key and delete the old one.

Zelyx keys (nk_…)

Each developer creates their own Zelyx key under Zelyx proxy keys on the API Keys page. The key is tied to the signed-in user for per-person attribution in the Team analytics page.

Key format

nk_<12-char-id>_<43-char-secret>
 │   │              └── 256 bits of entropy, URL-safe base64
 │   └── Public lookup prefix (stored in DB, used to find the key record)
 └── Literal prefix

The raw key is shown once on creation — copy it immediately. Only a SHA-256 hash is stored, so there is no way to retrieve the secret later. If you lose it, revoke and generate a new one.

Creating a Zelyx key

1. Go to API Keys → Zelyx proxy keys → New proxy key.
2. Add a label (e.g. laptop, ci-pipeline, prod-agent).
3. Optionally set a daily budget, team, project, or model restrictions.
4. Click Generate. Copy the key immediately.

Per-key settings

These constraints are applied by the gate on every call made with the key.

Revoking a key

Click the trash icon next to the key on the API Keys page. Revocation is immediate — in-flight requests with the key will still complete, but no new requests will be authenticated. Revocation is soft-delete: the key record remains for audit purposes.