Authentication

Every API request requires an API key passed in the Authorization header.

API key format

Authorization: Bearer chr_sk_live_a1b2c3d4e5f6...

Chronary issues two keys per organization:

Key prefix	Mode	Purpose
chr_sk_live_*	Live	Production data, counts against quotas
chr_sk_test_*	Test	Isolated test data, free and unlimited

Getting your keys

1. Sign up at console.chronary.ai
2. Your live and test keys are shown on the dashboard
3. Copy the key — it’s only shown in full once

Caution

API keys are stored as irreversible SHA-256 hashes. If you lose your key, regenerate it from the console. The old key is revoked immediately.

Test mode vs live mode

Test mode (chr_sk_test_*) is completely isolated from live data:

Behavior	Live	Test
Data isolation	Production data	Separate test data
Quota enforcement	Yes — counted monthly	No limits
Webhook delivery	Yes	Yes (same behavior)
Rate limiting	10 req/sec	10 req/sec

Use test keys for development, CI/CD, and integration testing. Switch to live keys for production.

curl

# Test mode — free, unlimited, isolated data
curl https://api.chronary.ai/v1/agents \
  -H "Authorization: Bearer chr_sk_test_your_key_here"

# Live mode — production data, quota-tracked
curl https://api.chronary.ai/v1/agents \
  -H "Authorization: Bearer chr_sk_live_your_key_here"

JavaScript

const API_KEY = process.env.CHRONARY_API_KEY; // test or live

const response = await fetch('https://api.chronary.ai/v1/agents', {
  headers: { 'Authorization': `Bearer ${API_KEY}` },
});

Python

import os, requests

API_KEY = os.environ['CHRONARY_API_KEY']  # test or live

response = requests.get(
    'https://api.chronary.ai/v1/agents',
    headers={'Authorization': f'Bearer {API_KEY}'},
)

Key security

• Keys are hashed with SHA-256 before storage — we never store the raw key
• Only the key prefix is shown in the console after initial creation
• Regenerating a key immediately revokes the previous one
• Never commit keys to source control — use environment variables

Error responses

Status	Cause	Fix
401 Unauthorized	Missing or invalid API key	Check the Authorization: Bearer header
429 Too Many Requests	Rate limit exceeded (10 req/sec)	Respect the Retry-After header
429 Too Many Requests	Monthly quota exhausted	Upgrade your plan or wait for monthly reset

See Error Codes for the full error reference.