Get started

Authentication

Two kinds of key, pointed at two different things, and never interchangeable.

	`sk_` customer token	`ak_` end-user key
Held by	Your backend	Your customer's client, or your server on their behalf
Reaches	`api.ourseams.com`	`<slug>.gw.ourseams.com`
Can	Mint keys, read every end user's spend	Make one call through the gateway
Bound to	An organization	One end user and their balance
If it leaks	Rotate immediately, it can mint	Revoke that one key

Never ship an sk_ to a browser, a mobile app or an agent you do not control. It can mint keys against any of your end users and read what all of them spent.

Getting a customer token

Tokens are minted, listed and revoked like anything else. Give each one a label, because a token you cannot identify is a token nobody will ever dare revoke.

cli

seams tokens create --label ci

# key        sk_acme_…
# key prefix sk_acme_ci0000
# last four  9f2c
# warning    shown once; store it now

cli

seams tokens list
seams tokens revoke apk_01JQZ8N4KP00000000000CI --yes

Where the CLI keeps yours

seams auth login writes the token to ~/.seams/config.json. In CI, put it in an environment variable instead and read it back where a command needs it.

cli

seams auth login --token "$SEAMS_API_KEY"
seams auth token      # prints it, for $(seams auth token)
seams auth logout     # forgets it

The SDKs take the token as a constructor argument and never read a file. new Seams({ apiKey }) in TypeScript, Seams(api_key=…) in Python.