Authentication

All requests are authenticated with your API key (prefix sk-st-). Send it in the Authorization header:

Authorization: Bearer sk-st-your-key

Base URL for all OpenAI-compatible endpoints:

https://api.staik.se/v1

The Anthropic endpoint

POST /v1/messages also accepts the Anthropic convention x-api-key — the same key works in both headers:

x-api-key: sk-st-your-key

Handle keys safely

• Put the key in an environment variable (e.g. STAIK_API_KEY), never in source code
• Keys are stored hashed on our side and cannot be shown again — if you lose it, generate a new one from the dashboard
• Every response includes rate limit headers so you can track your consumption per request

Calling from the browser (CORS)

The API only accepts browser requests from our own domains. Every other origin, http://localhost included, is rejected at the preflight:

400 Disallowed CORS origin

This is deliberate. A request made straight from the browser has to carry the API key in clear text in your frontend code, and the key is tied to your account and your token balance. The block is there so a key does not end up in a public bundle by accident.

Call from your backend instead

Server-to-server requests send no Origin header, so no CORS rules apply. curl, Python, Node and every OpenAI-compatible SDK work as-is against https://api.staik.se/v1.

In development, a thin proxy route that takes the request from your frontend and adds the key server-side is enough:

// app/api/chat/route.ts (Next.js)
export async function POST(req: Request) {
  const upstream = await fetch("https://api.staik.se/v1/chat/completions", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Authorization: `Bearer ${process.env.STAIK_API_KEY}`,
    },
    body: await req.text(),
  });
  return new Response(upstream.body, { status: upstream.status });
}