How do Cognocient proxy keys work?

Cognocient proxy keys are how your application authenticates with the proxy. One key per environment, per team, or per product — scoped to exactly what each caller needs.

Cognocient proxy keys (sk-cog-...) replace your provider API keys in your application. One key per environment or team — your real provider keys are stored encrypted server-side and never exposed in logs or API responses.

Same key, two different jobs

This is the key you use for the proxy's base_url swap. It's also the exact same key the Python async wrapper expects as its cognocient_key parameter — the wrapper reuses this key mechanism rather than inventing a separate credential type. The CSV/OTel importer doesn't need a key at all; it authenticates with your logged-in session instead.

Key architecture

Your Cognocient proxy key replaces the AI provider API key in your application. Cognocient holds your actual provider keys in a vault — they never appear in your codebase or environment variables.

# Before (provider key in environment)
OPENAI_API_KEY=sk-proj-xxxxxxxxxxxxxxxxxxxxxxxx

# After (Cognocient proxy key — scoped, rotatable, auditable)
OPENAI_API_KEY=sk-cog-prod-support-xxxxxxxx
           ↑   ↑    ↑       ↑
           cog prefix  environment  team/feature scope  unique ID

Feature	Description
No provider key exposure	Your OpenAI / Anthropic keys are stored encrypted in Cognocient's vault. A leaked proxy key cannot be used to call providers directly.
Revocable	Revoke a compromised or retired key from the dashboard in one click. Revocation is immediate and permanent — there's no undo, so keep a replacement key ready before you revoke.
Per-key spend visibility	Every call is attributed to the key that made it. Filter the API Call Log by key to see exactly what a specific environment or team is spending.
Velocity Limit	Each key has its own token-per-minute circuit breaker — auto-tripping at 10× its rolling baseline, or a manual cap you set. See Guardrails for details.

Creating a key

Go to Settings → Proxy Keys → Create key. Give it a name — e.g., "Production — Customer Support" or "Staging — Engineering." This appears in the API Call Log and spend reports. That's the only field: a proxy key isn't scoped to specific providers, models, or a spend cap — it authenticates as your account and inherits your account's budgets, routing rules, and velocity protection.

To restrict spend by provider, model, or amount, use Budgets (scoped by feature, department, or team via attribution headers) rather than the key itself.

Best practices for key management

One key per environment — Create separate keys for production, staging, and development. This prevents staging traffic from inflating your production cost reports, and lets you revoke one environment's access without affecting the others.

One key per team — If multiple teams access the proxy, give each team its own key. Combined with attribution headers, this makes it easy to see which team a given call came from in the API Call Log.

Store keys in environment variables only — Never hardcode proxy keys in source code. Use .env files locally and your secret manager (AWS Secrets Manager, GCP Secret Manager, Doppler) in production.

Revoke, don't reuse, a suspected-leaked key — Revocation is immediate and can't be undone. Create a replacement key first, roll it out, then revoke the old one.

Pair keys with a budget — A key has no spend cap of its own. Set a budget scoped to the feature or department using that key so a leaked or misbehaving key can't run up an unbounded bill.

Using a proxy key in your code

from openai import OpenAI
 
# Replace your provider key with the Cognocient proxy key
# The base_url points to the Cognocient proxy instead of OpenAI
client = OpenAI(
    api_key="sk-cog-prod-support-xxxxxxxx",  # your Cognocient key
    base_url="https://api.cognocient.com/v1",
)
 
# Everything else stays exactly the same
response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Hello"}],
    extra_headers={
        "X-Cost-Feature": "support-chat",
        "X-Cost-Department": "customer-success",
    },
)

How do Cognocient proxy keys work?

Key architecture

Creating a key

Best practices for key management

Using a proxy key in your code

On this page