PYLVA_API_KEY, and use it everywhere: it streams usage and costs through the SDK, reads rules and budgets, imports data, and manages pricing. Any AI agent holding it can operate your entire Pylva workspace for you.
Create a key
- Open pylva.com/settings/keys - after sign-in it lands on Settings -> API keys. Only workspace owners can create or revoke keys; members see a read-only list.
- Click Create key. New keys use the
pv_live_*prefix. On a brand-new workspace, the dashboard’s Get started checklist can mint an API key in one click. - Copy the plaintext from the save-your-key dialog immediately - it is shown once, then only a one-way hash is stored.
pv_live_{8 hex}_{32 hex}. Older pv_cli_* keys remain valid; see Prefixes.
One key, every endpoint
The key covers all endpoint families:
- Submit telemetry events
- Sync rules
- Fetch pricing
- Sync budget accumulators
- Manage custom pricing
- Import cost sources
- Understand cost source discovery
Creating and revoking keys
- Only workspace Owners can create or revoke keys; every mint and revoke is audit-logged.
- The plaintext key is shown once, in a save-your-key dialog with a copy button. Pylva stores a one-way verification hash, never the plaintext.
- Revoke a key from Settings -> API keys the moment it might be exposed; revocation propagates within seconds.
Prefixes
New keys use thepv_live_* prefix. Older keys created before the universal key existed may use pv_cli_* — they remain fully valid and now work on every endpoint, in the SDKs, and in the CLI. Prefixes carry no permission meaning.
Security
Because one key can do everything, treat it like a password:- Store it in a backend secret store as
PYLVA_API_KEY. - Never expose Pylva keys in browser code, mobile apps, prompts, completions, logs, or telemetry metadata.
- Prefer one key per environment (production, staging, CI) with a clear label, so revoking one does not take down the others.
- Rotate by creating a new key, switching your runtime secret, then revoking the old key.