Authentication

Requests authenticate with an API key. Send the key as a bearer token in the Authorization header:

Authorization: Bearer YOUR_API_KEY

Create keys on the API keys page of the dashboard. Give the key a name. You can also set a spending limit and an expiry date. See Balance and key limits.

The dashboard shows the full key once, right after you create it. A key starts with cherry_. If you lose a key, revoke it and create a new one. A revoked key stops working from its next request.

All endpoints take the key in the Authorization: Bearer header. POST /v1/messages also accepts the key in the x-api-key header, because the Anthropic SDKs send it there. No other endpoint reads x-api-key.

The generation endpoints (chat, images, and videos), the job endpoints, the balance and key endpoints, and the webhook endpoints need an API key.

These endpoints need no API key:

• GET /v1/models
• GET /v1/models/{vendor}/{model}
• POST /v1/estimate
• GET /v1/files/{token}: the signed URL of an output file is the credential. See Jobs.

A request without a valid key returns 401 with the code unauthorized, and the response has a WWW-Authenticate: Bearer header. The error is the same when the key is missing, malformed, unknown, revoked, or expired, so it does not tell you which one. Check that you copied the whole key, and create a new key if needed. POST /v1/messages returns the error in the Anthropic shape. See Chat.

GET /v1/key returns the key that sent the request. It shows the name, the last four characters, the expiry date, the spending limit, and the usage. See Balance and key limits.

curl "https://api.sakuranbo.ai/v1/key" \
  -H "Authorization: Bearer $SAKURANBO_API_KEY"

const response = await fetch("https://api.sakuranbo.ai/v1/key", {
  headers: {
    Authorization: `Bearer ${process.env.SAKURANBO_API_KEY}`,
  },
});
const data = await response.json();
console.log(data);

import os

import requests

response = requests.get(
    "https://api.sakuranbo.ai/v1/key",
    headers={
        "Authorization": f"Bearer {os.environ['SAKURANBO_API_KEY']}",
    },
)
print(response.json())

Every response includes an X-Request-Id header. To correlate your own logs, send an X-Request-Id of 8 to 64 characters (A-Z, a-z, 0-9, _, -) and it is used as the request ID. Error responses repeat the ID in error.request_id. POST /v1/messages puts it in the top-level request_id field instead, because its errors use the Anthropic shape.

Store your key in an environment variable such as SAKURANBO_API_KEY. Do not put it in client-side code or a public repository. Call the API from your server, including POST /v1/messages. Browsers cannot send the x-api-key header to the API, because its CORS rules do not allow that header.

To connect a coding agent, see the MCP server. It accepts an API key or an OAuth sign-in.