Authentication

API keys

Every API key is scoped to one project. Keys are stored as a SHA-256 hash; we show the cleartext exactly once at creation. Lose it, rotate it. Pass the key as apiKey to the AI SDK's streamText and it rides the standard Authorization: Bearer header on every request.

Create a key

In the dashboard: Keys → New API key → pick a project → name it → copy.

Rotate a key

Click Rotate on any key. We issue a new key, you update your env, then revoke the old one. Both keys are valid for ~5 seconds during the swap window.

Revoke a key

Click Revoke. The key stops working within ~5 seconds (cache-aware). Revoked keys never come back — issue a new one.

Passing the key

Standard Authorization: Bearer <key> header — identical to OpenAI / Anthropic SDKs. Point any compatible client at the right base URL:

const client = new OpenAI({
  apiKey: process.env.MG_KEY,
  baseURL: "https://synapse.garden/api/v1",
})

const client = new Anthropic({
  apiKey: process.env.MG_KEY,
  baseURL: "https://synapse.garden/api",
})

import { generateText } from "ai"

await generateText({
  model: "openai/gpt-5.4",
  baseURL: "https://synapse.garden/api/v1",
  apiKey: process.env.MG_KEY,
  prompt: "...",
})

Per-environment keys

Best practice: one key per (project, environment). A typical setup looks like this:

acme-prod-server      mg_live_a1b2…   (production VM)
acme-prod-edge        mg_live_c3d4…   (edge functions)
acme-staging          mg_live_e5f6…   (staging cluster)
acme-local-developer  mg_live_g7h8…   (per-developer; rotates monthly)

OIDC (build / CI / local dev)

For Vercel deployments and CI, you can authenticate via the OIDC token instead of a long-lived API key:

const client = new OpenAI({
  apiKey: process.env.VERCEL_OIDC_TOKEN, // 12-hour TTL, auto-rotated
  baseURL: "https://synapse.garden/api/v1",
})

OIDC tokens are auto-injected on Vercel deployments and refreshed every 12 hours. Use them when you don't want long-lived secrets in your env.

Audit trail

Every key action — created, rotated, revoked, used — lands in the audit log:

Visible at Dashboard → Audit log. Retention: 90 days (Pro+) or unlimited (Scale).

Security defaults