Authentication

Cynos uses two authentication mechanisms depending on what you're doing:

Virtual keys

Virtual keys are the primary way to authenticate inference requests. They start with sk-cy- and are scoped to a project.

Passing your virtual key

You can pass a virtual key in any of these ways:

Authorization header (recommended):

curl https://api.cynos.averlon.ai/v1/chat/completions \
  -H "Authorization: Bearer sk-cy-your-api-key" \
  -H "Content-Type: application/json" \
  -d '{...}'

x-cy-vk header:

curl https://api.cynos.averlon.ai/v1/chat/completions \
  -H "x-cy-vk: sk-cy-your-api-key" \
  -H "Content-Type: application/json" \
  -d '{...}'

x-api-key header:

curl https://api.cynos.averlon.ai/v1/chat/completions \
  -H "x-api-key: sk-cy-your-api-key" \
  -H "Content-Type: application/json" \
  -d '{...}'

Creating virtual keys

Create a virtual key through the Cynos management console.

The virtual key starts with sk-cy-. Save it - the full secret is shown only once.

Virtual key properties

• Project-scoped - Each key belongs to one project
• Quotas - Not supported currently. We will soon add support for this.
• Model keys (BYOK) - Not supported currently. We will soon add support for this.
• Revocable - Delete a virtual key to immediately revoke access

Security best practices

• Never expose virtual keys in client-side code
• Use separate keys per environment (dev, staging, production)
• Attach quota policies to limit blast radius
• Rotate keys periodically by creating new ones and deleting old ones
• Use BYOK model keys when you want provider API key isolation per virtual key