AI Power Ups

Menu

Contents

Concepts

Keys and security

API keys are server-side secrets. What the API accepts, what it refuses, and what it retains.

API keys

  • Format apa_live_ followed by 43 base62 characters. Authentication uses a SHA-256 hash; the key is also stored encrypted so the dashboard can show it again.
  • Send it as Authorization: Bearer apa_live_…. Revocation from the dashboard is immediate. Create one key per deployment: usage is attributed per key in the ledger you can export from the dashboard.
  • The MCP URL form /mcp/k/<key> exists for hosts that cannot set headers; it places the key in a URL and must be treated as a secret (never in logs or public configs). REST integrations should always use the header.

No browser calls

The API's CORS allow-list contains only the AI Power Ups web app, with credentials disabled. A browser page on another origin cannot call it even with a valid key. Keep the key on your server and proxy the calls you need; never ship a key to client code.

OAuth for chat hosts

Chat hosts connect over MCP with OAuth (PKCE S256, one-hour access tokens, rotating 90-day refresh tokens). OAuth access tokens are also accepted on /v1 abilities routes, but OAuth responses omit billing fields. Application developers do not need OAuth; use a key. Details for hosts are on the assistant page.

What the service retains

  • Search sessions and their records for 24 hours after last use; request digests for 24 hours (searches, follow-ups) and 30 days (Sharpen).
  • A usage ledger per call (capability, provider, outcome, charge, timing) without request content, exportable from the dashboard.
  • Authorization headers are redacted in logs. Provider identifiers never leave the API; you only ever see srch_ and rec_ ids.
  • Sharpen sends the task, context, approach and draft to the reviewing model provider through OpenRouter; send only content you may share. See the privacy policy.

Transport

  • HTTPS only. JSON request and response bodies; bodies over 256 KB are refused.
  • Every error produced by the API carries a requestId; include it in support requests together with the capability and time. Never send a key.