API keys authenticate your requests. They are prefixed with sk- and shown in full exactly once at creation — only a hash is stored. A default key is created automatically when you sign up.
Programmatic key management goes through the management API at /v1/management/keys. It authenticates with a management key (mk-…) — a separate credential from your inference keys, created at Settings → Management Keys. For interactive management, use the Keys page.
The Go client has no keys resource, so call the endpoints directly with net/http.
req, _ := http.NewRequest("GET", "https://opendunes.com/api/v1/management/keys", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("OPENDUNES_MANAGEMENT_KEY"))
resp, err := http.DefaultClient.Do(req)
// resp body: { "data": [{ "id", "name", "key_prefix", "status", "created_at" }, ...] }
body, _ := json.Marshal(map[string]any{
"name": "production-backend",
"rate_limit_rpm": 120, // optional per-key limit
"allowed_models": []string{"anthropic/claude-sonnet-5"}, // optional allowlist
})
req, _ := http.NewRequest("POST", "https://opendunes.com/api/v1/management/keys", bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+os.Getenv("OPENDUNES_MANAGEMENT_KEY"))
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
// resp body: { "api_key": {...}, "raw_key": "sk-..." } — raw_key is returned ONCE
req, _ := http.NewRequest("DELETE", "https://opendunes.com/api/v1/management/keys/"+keyID, nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("OPENDUNES_MANAGEMENT_KEY"))
resp, err := http.DefaultClient.Do(req)
// → { "revoked": true }
There is no update operation — rotate by creating a new key and revoking the old one.