API key authentication — Python Architecture DSL

Authenticate scripts, CI, Codex, and MCP with a revocable key created by the signed-in Service Architect user.

When to use

Use an API key for the Python client and MCP asynchronous generation API. The Designer authenticates its user generation jobs with the signed-in Cognito session; it does not need a pasted API key. Python client username/password or ID-token mode remains a separate legacy compatibility path.

Behavior

Sign in and open API Keys from the navigation menu. Create a named key with an expiration, list its metadata, or revoke it. Only a revoked key can be permanently deleted; deletion removes its stored metadata and never restores access.
The full secret is shown only when the key is created; store it immediately in a local secret manager or git-ignored .env.
The client sends the key only to the Service Architect API and never to the presigned S3 download URL.
Keys are owned by one Cognito user and generation jobs can be read only by their owner.

.env variables properties

Local authentication and endpoint configuration.

PropertyTypeDescription

SERVICE_ARCHITECT_API_KEYsecret

Preferred personal key for the asynchronous generation API.

SERVICE_ARCHITECT_API_URLoptional URL

Production is the API-key default; override it for beta or another environment.

SERVICE_ARCHITECT_ID_TOKENlegacy secret

Use an existing Cognito token with the legacy synchronous endpoint.

SERVICE_ARCHITECT_USERNAME / PASSWORDlegacy secrets

Perform Cognito SRP only when no API key or ID token is supplied.

.env

SERVICE_ARCHITECT_API_KEY=sa_live_<key-id>_<secret>
SERVICE_ARCHITECT_API_URL=https://z06e41vwnl.execute-api.us-east-1.amazonaws.com/prod