Get an API key

Kaleidr is one platform, one SDK, one access system — AI, maps, and design, keyed by capability scopes. A key comes in two safe forms depending on where it runs; both belong to the same org and bill against the same quota.

Form	Prefix	Where it runs	What it does
Publishable (browser)	kld_pk_live_…	in HTML, the SDK, <kaleidr-map>	origin-locked; safe in page source; the SDK exchanges it for a short-lived session at runtime. Can't be a server bearer or manage keys.
Server (backend)	kld_sk_live_…	your servers only	full bearer for server-to-server calls; optional IP allowlist / caps / expiry. Browser-blocked (no CORS).

Legacy keys keep working

Existing kld_live_… keys continue to authenticate unchanged. When you're ready, create a publishable key for browser embeds and a server key for backend calls — you don't have to migrate to keep running.

Where to manage keys

Manage keys at kaleidr.com/api-keys (organization admins only).

What your plan includes

Every plan can mint keys. On the Free plan a key serves basemaps only — it's issued as a publishable key with the maps scope and the tile product, so you can put a Kaleidr basemap on your site within the plan's map-loads allowance. Pro and Enterprise unlock the rest: server keys, the ai and design scopes, and the chat and editor products. Your plan also sets the org's shared monthly budget; see Quota & rate limits.

Test keys

Both forms come in a test variant (kld_pk_test_…, kld_sk_test_…).

A test key is not a sandbox. It authenticates against the same API, calls the same models, and draws down the same monthly allowance as a live key. Two things differ, and that is all:

• a test publishable key may be created without an origin allowlist, where a live one may not;
• a test key cannot serve basemap tiles.

So use a test key to keep staging traffic attributable and separately revocable — that is real value. Do not treat it as free, and do not leave one in a public development page believing it costs nothing.

Which one do I need?

• Embedding in a web page (chat, editor, tile via the SDK or <kaleidr-map>) → a publishable key. Lock it to your site's origins.
• Calling the platform API from your own backend → a server key, sent as a bearer token. Keep it out of the browser and out of version control.

If you do both, mint one of each — same org, same bill.

Mint a key

1. Sign in and open API Keys under your account.
2. Create a key — name it and pick Browser (publishable) or Server. On Pro and Enterprise it's minted with the ai, maps, and design scopes (full platform); on Free it's a Browser key scoped to maps / tile, and the Server option isn't offered.
   • A Browser key must be locked to at least one allowed origin (the sites permitted to use it) — a live publishable key without origins is rejected, since it would be a standing secret in page source.
3. Copy the kld_pk_live_… / kld_sk_live_… value once — it's shown a single time and never re-displayed. Store it somewhere safe.

Use it

In the browser, pass the publishable key as the publishable-key attribute / publishableKey option — the SDK exchanges it for a short-lived, origin-bound session so the publishable key itself is never a standing credential:

<kaleidr-map product="tile" publishable-key="kld_pk_live_…" style-id="kaleidr-morning"></kaleidr-map>

From a server, send the server key as a bearer token:

Authorization: Bearer kld_sk_live_…

The key authenticates as your organization. Usage bills against the org's monthly quota. See Auth & scopes for what each scope unlocks and CORS & allowed origins for the browser-origin allowlist.

Viewer needs no key

Embedding a published map (product="viewer") is share-link gated — no key required. Keys are for chat, editor, and tile.