Authentication

Every request to Volt is authenticated and mapped server-side to a SPIFFE tenant ID, then audited.

API keys

Public clients use an API key of the form volt_sk_live_.... Pass it explicitly or set VOLT_API_KEY.

from volt import Volt
client = Volt(api_key="volt_sk_live_...")  # or rely on VOLT_API_KEY

curl https://api.voltcloud.ai/v1/models \
  -H "Authorization: Bearer $VOLT_API_KEY"

The secret is shown once at issue time. Store it in a secret manager, not in source control.

Issue and revoke keys

Use voltctl:

voltctl key issue  --org <org-id> --name "ci"
voltctl key list   --org <org-id>
voltctl key revoke <key-id> --org <org-id>   # global, effective in under 30s

Human admins

Admins sign in with OIDC (Okta, Entra, or Google Workspace) in the console. OAuth2 device flow is available for CLI sign-in. API keys are for machine clients.

Base URL

Default is https://api.voltcloud.ai. Override with --base-url / VOLT_BASE_URL, or the base_url client argument, for staging.