Configuration

Client-side

Two variables cover every client (SDK, MCP, your own code):

Variable	Default	Notes
VENKAI_API_KEY	—	vk_live_… or vk_test_…. Sent as Authorization: Bearer <key>.
VENKAI_BASE_URL	https://api.venkai.fr (MCP server) · http://127.0.0.1:8000 (Python SDK)	The two defaults differ — pass it explicitly and the ambiguity goes away.

export VENKAI_API_KEY="vk_live_…"
export VENKAI_BASE_URL="https://api.venkai.fr"

Key environments

POST /api/auth/api-keys takes environment, which must be production or development, and controls the prefix:

Prefix	Meaning
vk_live_	Production key
vk_test_	Development key

Both are accepted by the API and grant the same organization scope. The prefix is a signal for humans and log scrubbers, not a permission boundary — a vk_test_ key reads and writes your real data.

Keeping keys out of source control

# .env — and make sure .env is in .gitignore
VENKAI_API_KEY=vk_live_…

import os
from venkai.sdk.client import VenkaiClient

client = VenkaiClient(
    api_key=os.environ["VENKAI_API_KEY"],   # raises KeyError if unset — fail loudly
    base_url=os.environ.get("VENKAI_BASE_URL", "https://api.venkai.fr"),
    project="billing-service",
)

Rotate with POST /api/auth/api-keys/{key_id}/rotate (revokes the old key and mints a new one with the same label) or revoke with DELETE /api/auth/api-keys/{key_id}.

Server-side

Nothing to configure on the hosted API. Private deployments are configured with the Venkai team — see Deployment options.

Rate limits

Applied per client IP, in a 60-second window, on the hosted API:

Caller	Limit
Authenticated (Bearer key or session cookie)	300 req/min
Anonymous	60 req/min

Exceeding it returns 429 with a Retry-After header.