Set up a ThunderPhone API key

1. Choose the creation path. In the dashboard, open Organization → Keys. To automate key creation, use POST /v1/developer/api-keys with an authenticated human admin session. Organization API keys cannot manage API keys.

{
  "name": "production"
}

2. Store the value once. Put the sk_live_... value in a secret manager or protected environment variable named THUNDERPHONE_API_KEY. Never paste it into source, chat, shell history, screenshots, logs, or a committed .env.
3. Send both standard headers. Every request made from this pack identifies its source with X-ThunderPhone-Client: skills/setup-api-key@1.0. The Python and TypeScript SDKs read THUNDERPHONE_API_KEY and send the authentication header automatically.
4. Verify the credential with a read-only agents request.

curl --fail-with-body https://api.thunderphone.com/v1/agents \
  -H "Authorization: Bearer $THUNDERPHONE_API_KEY" \
  -H "X-ThunderPhone-Client: skills/setup-api-key@1.0"

import os, requests

r = requests.get(
    "https://api.thunderphone.com/v1/agents",
    headers={
        "Authorization": f"Bearer {os.environ['THUNDERPHONE_API_KEY']}",
        "X-ThunderPhone-Client": "skills/setup-api-key@1.0",
    },
    timeout=30,
)
r.raise_for_status()
print(len(r.json()))

const response = await fetch("https://api.thunderphone.com/v1/agents", {
  headers: {
    Authorization: `Bearer ${process.env.THUNDERPHONE_API_KEY}`,
    "X-ThunderPhone-Client": "skills/setup-api-key@1.0",
  },
});
if (!response.ok) throw new Error(`${response.status}: ${await response.text()}`);
console.log((await response.json()).length);

5. Rotate without downtime. Create the replacement, update and verify every consumer, then delete the old key with DELETE /v1/developer/api-keys/{key_id}. Ask before revoking a key if its consumers are unknown.

Verify

The agents request should return 200. Confirm that logs contain the client header but never the bearer value.

Errors

Source and safety rules

• Treat the API response and API-key guide as authoritative.
• Confirm key-management fields in the developer API-key reference.
• Do not fabricate a key, log one, or ask a user to paste one into chat.
• Use placeholders for resource IDs and inspect each write response before the next write.

See references/authentication.md for the header contract and a safe rotation checklist.