Authentication

Every request to Faelith is authenticated with a bearer API key. Keys are created in Dashboard → API Keys and are shown once at creation; store them in a secret manager.

Authorization: Bearer sk-fae_...

Key purposes#

Each key has one purpose. The purpose decides which meter the request debits and which surfaces accept it.

A key never crosses purposes: a chat key cannot drive Code, and an api key is the only kind that reaches your wallet.

Data handling#

Every key uses the same ZDR inference path. Faelith separately retains complete encrypted model I/O and the complete chat transcript in its own S3 for 90 days. See Data handling.

Device login#

The CLI and desktop app can sign in without copying a key:

1. The client calls POST /api/cli/device and receives a device_code plus a short user_code.
2. You open https://faelithindustries.com/cli/login while signed in, type the code and approve.
3. The client polls POST /api/cli/device/poll until it receives a code-purpose key.

Codes are short-lived. Approving a code you did not request is the only way to leak a key, so the page asks you to type the code and shows the IP, client and time of the request; approving also asks you to confirm it is you and emails you. See Account security.

Sign out#

/logout in the CLI or Log out in the app deletes the stored keys locally and returns to the sign-in screen. Revoke the key itself under API Keys if the machine is lost.