Authentication

Authentication is essential for every request to the Synoria API. Each request needs a valid API key to identify your application and authorize access. To enhance security, store API keys in environment variables rather than hardcoding them. This practice minimizes risks and eases deployment. This guide will help you set up a secure environment, initialize the Synoria client, and ensure authentication is correctly configured.

Configure Your API Key

Store your API key as an environment variable. This prevents sensitive credentials from being exposed in source code or version control while making them accessible during runtime.

SYNORIA_API_KEY=sk_live_xxxxxxxxxxxxxxxxxxxxx
SYNORIA_ORGANIZATION=creative-studio
SYNORIA_PROJECT=website-template
SYNORIA_ENV

Initialize an Authenticated Client

Load your environment variables and initialize the Synoria client. Once configured, every request automatically includes the required authentication credentials.

import "dotenv/config";
import { Synoria } from "@Synoria-ai/sdk";

const client = new Synoria({
  apiKey: process.env.SYNORIA_API_KEY,
  organization: process.env.SYNORIA_ORGANIZATION,
  project: process.env.SYNORIA_PROJECT,
  timeout: 30000,
});

console.log("Authentication initialized.");
console.log(`Environment: ${process.env.SYNORIA_ENV}`);

export default client;

Verify Your Connection

Before sending production requests, verify that your API key is valid by retrieving your available models. This is a quick way to confirm authentication has been configured correctly.

import client from "./client.js";

async function verifyConnection() {
  try {
    const models = await client.models.list();

    console.log("Connected successfully.");
    console.log(`Available models: ${models.length}`);
    console.log(models.map(model => model.id));
  } catch (error) {
    console.error("Authentication failed.");
    console.error(error.message);
  }
}

verifyConnection();

Security Best Practices

Never expose API keys in frontend code, public repositories, or client-side applications. Rotate credentials regularly, assign separate keys for development and production, and revoke unused keys immediately to maintain a secure environment.