Get an API key

Kaleidr is one platform, one SDK, one access system — AI, maps, and design, keyed by capability scopes. A key comes in two safe forms depending on where it runs; both belong to the same org and bill against the same quota.

Form	Prefix	Where it runs	What it does
Publishable (browser)	kld_pk_live_…	in HTML, the SDK, <kaleidr-map>	origin-locked; safe in page source; the SDK exchanges it for a short-lived session at runtime. Can't be a server bearer or manage keys.
Server (backend)	kld_sk_live_…	your servers only	full bearer for server-to-server calls; optional IP allowlist / caps / expiry. Browser-blocked (no CORS).

Legacy keys keep working

Existing kld_live_… keys continue to authenticate unchanged. When you're ready, create a publishable key for browser embeds and a server key for backend calls — you don't have to migrate to keep running.

Availability

Self-serve key management is rolling out. When it's live, manage keys at kaleidr.com/api-keys (organization admins only).

Included with paid plans

API keys come with the Pro and Enterprise plans — on the Free plan the API Keys page offers an upgrade instead. Your plan sets the org's shared monthly budget; see Quota & rate limits.

Which one do I need?

• Embedding in a web page (chat, editor, tiles via the SDK or <kaleidr-map>) → a publishable key. Lock it to your site's origins.
• Calling the platform API from your own backend → a server key, sent as a bearer token. Keep it out of the browser and out of version control.

If you do both, mint one of each — same org, same bill.

Mint a key

1. Sign in and open API Keys under your account.
2. Create a key — name it and pick Browser (publishable) or Server. It's minted with the ai, maps, and design scopes (full platform).
   • A Browser key must be locked to at least one allowed origin (the sites permitted to use it) — a live publishable key without origins is rejected, since it would be a standing secret in page source.
3. Copy the kld_pk_live_… / kld_sk_live_… value once — it's shown a single time and never re-displayed. Store it somewhere safe.

Use it

In the browser, pass the publishable key as the publishable-key attribute / publishableKey option — the SDK exchanges it for a short-lived, origin-bound session so the publishable key itself is never a standing credential:

<kaleidr-map product="tile" publishable-key="kld_pk_live_…" style-id="kaleidr-morning"></kaleidr-map>

From a server, send the server key as a bearer token:

Authorization: Bearer kld_sk_live_…

The key authenticates as your organization. Usage bills against the org's monthly quota. See Auth & scopes for what each scope unlocks and CORS & allowed origins for the browser-origin allowlist.

Viewer needs no key

Embedding a published map (product="viewer") is share-link gated — no key required. Keys are for chat, editor, and tile.