Key facts
| Startup fit | Hosted OIDC sign-in; one scoped key per environment |
| API auth | Bearer API keys, scoped per environment and revocable on rotation |
| Free plan | plugsky-micro and plugsky-lite, no card; 2 API keys |
| Trial | 14-day full-access trial for higher tiers |
| Models | 30+ models behind one OpenAI-compatible API |
| Migration | Change the base URL and model name; keep your SDK |
| Audit | Authentication and key lifecycle events available for review |
| SSO | SSO with SCIM available when you need team access controls |
TL;DR
- Do not build an authorization server; use a hosted OIDC provider for user sign-in.
- Keep one scoped Plugsky key per environment; never ship it to the client.
- Develop free with plugsky-micro and plugsky-lite, no card.
- Add SSO and entitlement mapping when an enterprise deal or audit forces it.
- Rotate keys on a schedule; revocation should be a one-minute job, not a project.
How it works, step by step
- Add a hosted OIDC provider for user sign-in instead of writing your own OAuth server; wire up one provider well.
- Generate a scoped Plugsky key per environment and store it in your deployment platform's secret store, not in the repo or client bundle.
- Call the API only from server-side code paths; if you need edge functions, keep the key in the server-side environment.
- Map your user or workspace record to a quota bucket so usage is attributable from day one.
- Log user, model, tokens and latency per call, and alert on abnormal spend per key.
- Rotate keys every quarter and immediately after any team or vendor change.
- Add SSO, SCIM and per-customer keys when the first enterprise security review asks for them.
Original data
Try it yourself
Open the API key security checklist →
Skip the authorization server
Building OAuth 2.0 correctly — PKCE, token rotation, consent screens, session fixation defences — is weeks of work that adds nothing to your product. Use a hosted OIDC provider: sign-in, social login, MFA and session management become configuration. Your effort belongs in the product and in the one integration that matters: calling the model API safely.
Plugsky's role in this picture is deliberately small. API calls authenticate with scoped bearer keys, so there is no second OAuth server to run inside your app. The console offers SSO with SCIM when you eventually need team-level controls.
The minimum viable secure flow
The whole pattern is four lines of responsibility. Users authenticate with the hosted provider. Your backend receives a session. Your backend attaches a scoped Plugsky key from the environment and calls the OpenAI-compatible endpoint. Your logging records who, which model, how many tokens.
- Environments: separate keys for dev, staging and production.
- Secrets: platform secret store, injected at runtime; never in client code.
- Attribution: tag requests with user or workspace identifiers.
- Alerts: budget and anomaly alerts per key.
When to invest in more identity
Three triggers justify more work: an enterprise customer sends a security questionnaire, an audit or framework requires segregation of duties, or the number of services and environments makes manual key handling fragile. At that point add SSO and SCIM for your team, per-customer key sets, and a thin broker in your backend.
Until then, keep the surface small. Start on the free plan — plugsky-micro and plugsky-lite, no card — and move to a paid plan or the 14-day full-access trial when real traffic arrives. See the live pricing page for tiers. Flat monthly plans keep the model layer from becoming a variable cost that scares your finance lead.
Honest comparison
| Concern | Plugsky starter pattern | Building OAuth yourself | Enterprise-grade setup |
|---|---|---|---|
| User sign-in | Hosted OIDC provider | Custom authorization server | Your IdP plus SCIM |
| Model access | Scoped key per environment | N/A | Broker and per-tenant keys |
| Effort to launch | Days | Weeks to months | Weeks, with governance |
| Cost | Free plan, no card | Engineering time | Flat monthly plans |
| When it breaks | Rotate one key | Security incident risk | Documented incident process |
Frequently asked questions
Do we need OAuth to call Plugsky?
No. Backend calls use a scoped API key. Add OAuth or OIDC when you have users who sign in to your product, and keep that flow in a hosted provider.
Can we start without a credit card?
Yes. The free plan includes plugsky-micro and plugsky-lite and two API keys with no card, which covers development, demos and early design partners.
How do we stop a leaked key from costing us?
Keep keys server-side, scope them per environment, set spending and rate alerts, and rotate fast. A leaked key should be revocable in minutes.
Should we give each user their own key?
No. Give each environment and service its own key, and attribute usage with metadata instead of distributing credentials.
When should we add SSO and SCIM?
When an enterprise customer asks, when you grow past a small team, or when an audit requires documented lifecycle controls — not before.
Is the API portable if we outgrow it?
Yes. It is OpenAI-compatible, so switching model or base URL is a configuration change rather than a rewrite.
What is live today?
Chat completions with streaming, JSON mode and function calling, plus embeddings. Audio, images, files, batch, moderation, fine-tuning and assistants endpoints are labelled coming soon.