Release note: All Model API Keys are upgraded to Privacy Keys. The full plaintext key is shown only once, when creation or reset succeeds. After you close the dialog, you cannot view or copy it again.
Important
Anyone who holds your Privacy Key can call models as you and incur charges. Copy the key immediately and store it offline in a secure place. After you close the creation dialog, the console shows only a masked value and the plaintext cannot be viewed again.
If a key is lost or leaked, disable or reset it in the console right away, then create a new key and update your application configuration.
1. What is a Privacy Key
A Privacy Key is the credential used to authenticate Canopy Wave Model API requests. The platform validates identity with a Bearer token and attributes usage and billing to the account that owns the key.
The Canopy Wave API is compatible with the OpenAI interface. Set api_key to your Privacy Key and base_url to https://inference.canopywave.io/v1 to use existing SDKs and tools.
What this security upgrade addresses
Before the upgrade, the console let you view and copy the full key at any time. If a console session was shared, screen-recorded, or accessed without authorization, the key could be obtained again. After the upgrade:
- The full plaintext key is displayed only once, when creation or reset succeeds.
- After you close the dialog, the list shows only a masked key (for example, cw****key), plus the name, status, created time, and last-used time.
- The platform does not store reversible plaintext and does not recover old keys through support tickets. If a key is lost, reset it or create a new one.
- Calling capability and billing rules are unchanged. Legacy keys remain usable during the transition period. Rotate them as soon as possible.
2. Before and after the upgrade
| Item | Before (legacy key) | After (Privacy Key) |
|---|---|---|
| View plaintext | The full key can be copied from the console at any time | Shown only once on create or reset; cannot be viewed after the dialog is closed |
| List display | Full key, or the plaintext can be revealed in one click | Masked value only, such as cw****key |
| Recover a lost key | Copy it again from the console | Cannot be recovered; reset or create a new key |
| Calling capability | Calls the Model API normally | Same as a legacy key; protocol and models are unchanged |
| Billing and quota | Billed against the account or plan | Rules unchanged; a deleted key incurs no new charges |
| Recommended action | Create a new Privacy Key and replace the legacy key | Copy the key immediately after creation and store it in a secrets vault |
Legacy keys are not invalidated on the day of the upgrade. To reduce exposure, delete or disable each legacy key after you finish switching production traffic.
3. Get a Privacy Key
3.1 Sign up and sign in
Register with your email and sign in to Canopy Wave Cloud: https://cloud.canopywave.io
After you sign in, go to Model API → Model API Key (direct link: https://cloud.canopywave.io/model-api-key). The system does not create a key automatically when you open an account. You must create one yourself.
3.2 Create a new key
- On the Model API Key page, click New Model API Key.
- Click Create. The system generates a Privacy Key and opens a one-time display dialog.
- Copy the full key immediately, or download the backup file. Confirm it is saved before you close the dialog.
One-time display rule
After the dialog is closed, you cannot view or copy the plaintext again. The Copy action in the list copies only the masked value and cannot be used for authentication.
Before you close the dialog: copy the key into a password manager or secrets vault, write it into server environment variables, and share it with teammates who need it through a secure channel. Do not send the plaintext in instant messaging.
If you close the dialog before saving the key, reset it or delete it and create a new one. Do not ask Support to send back the old plaintext.
3.3 Recommended ways to store the key
- Personal development: a password manager such as 1Password, Bitwarden, or the system keychain.
- Production: a cloud secrets manager, Kubernetes Secret, or protected CI variables. Never commit keys to a code repository.
- Local debugging: a shell environment variable or a .env file that is not tracked by Git (make sure .gitignore includes .env).
- Team collaboration: one key per person, or separate keys by environment (dev / staging / prod) so revocation and audit are easier.
4. Manage Privacy Keys
4.1 What you can see in the list
After the upgrade, the Model API Key list no longer provides plaintext. Each record typically includes a masked key, created time, a delete action (subscription-plan keys can be reset), and a description.
4.2 Reset a subscription-plan key (lost or leaked keys)
A reset immediately generates new plaintext and invalidates the old plaintext at the same time.
- In the actions menu for the target key, choose Reset.
- Confirm the risk prompt: the old key will become invalid immediately.
- Copy the new plaintext from the one-time dialog and save it.
- Update environment variables or settings in your servers, CI, and third-party tools, then verify the call.
After you delete an API key, it will not generate new usage charges. Historical spend remains available on the Billing page.
4.3 Migrate from a legacy key
- Create a new Privacy Key and save the plaintext as described in section 3.3.
- Complete a successful test call with the new key in staging or locally first.
- Switch production environment variables and tool configuration to the new key.
- After usage and error rates look normal and there is no remaining traffic on the old key, delete it.
- Remove any old plaintext embedded in clients, script repositories, or chat history.
5. Security practices
- Do not commit a Privacy Key to Git, paste it into a public issue, or share it in a screenshot in a group chat.
- Do not place a long-lived key in a browser frontend, a mobile app package, or any configuration file that users can view.
- Split keys by environment and service. Do not let a single key unlock every workload.
- Delete the corresponding key immediately when an employee leaves or a vendor engagement ends.
- If you see unexpected charges or calls from unfamiliar IPs, disable the key first, investigate, then reset it.
- Rotate production keys on a regular schedule.
If a key is leaked
- Immediately Delete or Reset the affected key in the console.
- Check Billing and request logs to confirm the time window and models involved.
- Replace the key in every running service, then Delete the old key.
- Contact support@canopywave.com or Discord if you need help.
6. Validity and billing
A Privacy Key remains valid indefinitely until it is disabled, reset, or deleted. After deletion, the key cannot be used and generates no new charges. Historical invoices remain available on the subscription and billing pages.
Calls may fail if the account balance is insufficient. Monitor plan usage in the console and upgrade as needed. See Price.
7. FAQ
Q1. Why can't I see the full key after I close the dialog?
This is by design for the Privacy Key upgrade. The platform no longer provides reversible plaintext, which reduces the risk of a second leak from a shared console session or a screenshot. Save the key when you create it. If it is lost, reset it or create a new one.
Q2. The Copy button in the list doesn't work for API calls.
The list can only copy the masked value. Authentication requires the full plaintext shown in the create or reset dialog.
Q3. Can Support recover the old plaintext for me?
No. After the upgrade, the system does not store recoverable plaintext. Reset the key, or create a new key and update your application configuration.
Q4. When does a legacy key stop working?
For security, disable and delete each legacy key as soon as you finish the switch. The platform may later announce a retirement date for legacy keys. Watch the console for notices.
Q5. I received 401 Unauthorized. What should I check?
Check the following in order: whether you used a masked or truncated string; whether the environment variable is actually loaded; whether the key has been reset, disabled, or deleted; whether the Authorization header is Bearer, a space, then the full key; and whether the Base URL is https://inference.canopywave.io/v1.
Q6. Will I still be charged after I delete a key?
The old key will not generate new usage charges. Historical spend remains visible on the Billing page.
Q7. How many keys can one account create?
Follow the current limit in the console. Split keys by environment and service, but do not create a new key for every script. Delete unused keys promptly.
Q8. Is a Privacy Key the same as a Cloud management API key?
No. A Model API Privacy Key is used for inference at https://inference.canopywave.io/v1. The Cloud management plane (projects, virtual machines, and so on) uses a separate account API. See Account Quick Start. Do not mix the two.
Canopy Wave
This document describes how to create, store, configure, and rotate keys after the Privacy Key security upgrade. If console copy differs from this document, the live product takes precedence.