Authentication - Valkyrie

Valkyrie accepts two kinds of credentials.

API keys (recommended for applications)

Send your key in the X-API-Key header:

curl https://valkyrie-back.azumo.com/{deployment_slug}/v1/chat/completions \
  -H "X-API-Key: $VALKYRIE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "{deployment_slug}", "messages": [{"role":"user","content":"Hi"}]}'

Because the API is OpenAI-compatible, the OpenAI SDKs send the key as an Authorization: Bearer header instead, Valkyrie accepts that too. Just set the SDK’s api_key to your Valkyrie key.

Key prefixes

Prefix	Purpose
`vk_dep_`	Calling a deployed model
`vk_mcp_`	Connecting through the MCP server

Create and revoke keys on the API Keys screen.

JWT bearer tokens (dashboard sessions)

People signed in to the dashboard authenticate with a session token (Authorization: Bearer <jwt>). This is handled for you by the web app; you don’t normally use JWTs for programmatic access, use an API key instead.

Good practices

Store keys in a secret manager or environment variables, never in source control.
Use a distinct key per application or environment so you can revoke narrowly.
Keys are environment-specific: a key issued in one environment will be rejected in another.