Custom APIs

For any other HTTPS API, create a Custom API key. You choose:

• The API address, such as https://api.example.com. It is fixed for the life of the key, so nobody can redirect your real key to another server. To change it, create a new key.
• How the key is sent: Authorization: Bearer, a header such as x-api-key, Basic auth, a URL parameter such as ?api_key=, a top-level field of the JSON body such as api_key, or OAuth client credentials.

OAuth client credentials (Microsoft Graph, Spotify, Salesforce, Zoom and many business APIs): paste the real key as CLIENT_ID:CLIENT_SECRET and give the token address, with a scope or audience if the API needs one. Vallkey asks for an access token, keeps it until it expires, and sends it as Authorization: Bearer. Your app simply sends the ghost key as its token; the client secret and the access token never reach it. The token address may be another host than the API, with the same rules: public HTTPS, fixed in the key.

1# Before2curl https://api.example.com/v2/orders -H "x-api-key: $REAL_KEY"3 4# After5curl https://api.vallkey.com/v2/orders -H "x-api-key: $GHOST_KEY"

Custom keys forward your request headers except credentials, cookies and connection details. Addresses must be public HTTPS hostnames: IP addresses, internal names and non-standard ports are refused. Supabase works with the preset in the dashboard (the key is sent as both apikey and a Bearer token).

Your app can always send the ghost key wherever it would send the real key, including a URL parameter. Vallkey finds it, removes it, and attaches the real key the way the provider expects. Ghost keys never reach the provider, and URL parameters are never stored in activity.

Which provider does a request go to?

The ghost key decides, never the path. gk_openai_… always goes to OpenAI and gk_stripe_… to Stripe, even when two providers use the same path. Custom and AWS keys go to the address saved in the key.