Authenticate with a key from API keys, then POST a list of messages to get a model response back.

Base URL

https://cylinkdev.vercel.app/api/cylink-api

Your first request

curl https://cylinkdev.vercel.app/api/cylink-api \
  -H "Authorization: Bearer cyk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "cyanix-core",
    "messages": [{ "role": "user", "content": "Hello!" }]
  }'

Your own system prompt

By default the assistant answers as Cyanix Intelligence. Send system_prompt — or a system turn in messages — and your instructions take that slot instead, so the assistant is yours.

curl https://cylinkdev.vercel.app/api/cylink-api \
  -H "Authorization: Bearer cyk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "system_prompt": "You are Otter, a terse assistant for a plumbing supply store. Never discuss anything else.",
    "messages": [{ "role": "user", "content": "Do you stock 15mm compression elbows?" }]
  }'

Three things change when you supply one. Tool use, grounding and citations still work — those are mechanics, not personality — but the assistant loses access to the Cyanix knowledge base and Devit, keeping only web search, YouTube search, image search and page reading. Stored user memories are not injected, so nothing personal leaks into your app's replies. And responses aren't scored against Cyanix's own principles, since they aren't Cyanix's responses.

The response reports cylink.system_prompt_used so you can confirm yours was applied.

JavaScript

const res = await fetch("https://cylinkdev.vercel.app/api/cylink-api", {
  method: "POST",
  headers: {
    "Authorization": "Bearer cyk_your_key_here",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    model: "cyanix-core",
    messages: [{ role: "user", content: "Hello!" }]
  })
});
const data = await res.json();
console.log(data.choices[0].message.content);

Python

import requests

res = requests.post(
    "https://cylinkdev.vercel.app/api/cylink-api",
    headers={"Authorization": "Bearer cyk_your_key_here"},
    json={
        "model": "cyanix-core",
        "messages": [{"role": "user", "content": "Hello!"}],
    },
)
print(res.json()["choices"][0]["message"]["content"])

OpenAI SDK recommended

Point baseURL at Cylink and the official SDKs work as-is — there's no Cylink client to install.

import OpenAI from "openai";

const client = new OpenAI({
  apiKey:  "cyk_your_key_here",
  baseURL: "https://cylinkdev.vercel.app/api/v1"
});

const res = await client.chat.completions.create({
  model: "cyanix-core",
  messages: [{ role: "user", content: "Hello!" }]
});
console.log(res.choices[0].message.content);

These take the same Authorization: Bearer cyk_your_key_here header and return errors in the same shape. They also accept your dashboard session token, which is how the Playground calls them — you don't need a key for that.

/axion — grounded chat recommended

One call that routes the query, pulls the knowledge base plus live web search, and answers — with the full trace attached. Free keys get a single grounded model; paid keys get the ensemble.

curl https://cylinkdev.vercel.app/api/axion \
  -H "Authorization: Bearer cyk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "query": "What is the latest news about Groq?" }'

Returns selected_route, confidence, trace_events and response with the final answer.

/axion — run one route

Skips the routing decision and executes the route you name, for example one you got back from ARI.

curl https://cylinkdev.vercel.app/api/axion \
  -H "Authorization: Bearer cyk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{ "query": "Reverse a string in Rust", "route": "code_execution" }'

Returns { model, response }. An optional context string is injected into the system prompt.

/usage — quota and spend

Live usage for the calling key. A key can only read its own stats.

curl https://cylinkdev.vercel.app/api/usage \
  -H "Authorization: Bearer cyk_your_key_here"

Returns { key_name, requests, cost_usd, limits, last_used_at }.

Read-only access to public Devit data: posts, profiles and search. It uses the same cyk_ key as everything else and counts toward your plan's requests. Only public content is exposed. There are no DMs, no emails and nothing unpublished. This API is in preview, so field names may still change.

Endpoints

Example

curl "https://cylinkdev.vercel.app/api/devit/posts?limit=2&tag=beta-tester" \
  -H "Authorization: Bearer cyk_your_key_here"

{
  "data": [
    {
      "id": "post_id",
      "content": "Looking for beta testers for my game.",
      "code_lang": null,
      "tags": ["beta-tester", "js"],
      "likes": 4,
      "comments": 2,
      "views": 61,
      "image_url": null,
      "author": { "username": "someone", "display_name": "Some One", "avatar_url": "https://..." },
      "created_at": "2026-10-05T14:02:11Z",
      "url": "https://devit-six.vercel.app/@someone/looking-for-beta-testers-a1b2c3d4"
    }
  ],
  "next_before": "2026-10-05T14:02:11Z"
}

Pass next_before back as before to fetch the next page; it is null on the last one. tag matches Devit's tag slugs, such as beta-tester, contributor or a topic like js. /devit/users returns { data: {…} } with the public profile fields, or a 404 NOT_FOUND. /devit/search returns { posts: […], users: […] }. Errors use the same shape as the rest of Cylink.

Let people sign in to your app with their Devit account. It is a standard authorization code flow with PKCE, and returns an RS256 id_token when you ask for the openid scope. Create an app under OAuth apps to get a client ID and secret. Apps belong to a Devit account, so you need to be signed in to Cylink with Devit, and each account can have up to 5.

Endpoints

1. Send the user to Devit

https://devit-six.vercel.app/authorize
  ?response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=https%3A%2F%2Fyourapp.com%2Fcallback
  &scope=identity%20openid
  &code_challenge=BASE64URL_SHA256_OF_VERIFIER
  &code_challenge_method=S256
  &state=RANDOM_VALUE

redirect_uri must exactly match one registered for your client. Only S256 PKCE is accepted. A client registered without PKCE has to send a nonce instead. Apps you create can request identity, profile, email and openid. identity is always included. profile unlocks the name, username and picture, and email unlocks the address. The id_token and userinfo carry only what was granted.

2. Exchange the code

curl https://nynrocdgmowjgslgfdmc.supabase.co/functions/v1/cx-token \
  -d grant_type=authorization_code \
  -d code=THE_CODE \
  -d redirect_uri=https://yourapp.com/callback \
  -d client_id=YOUR_CLIENT_ID \
  -d client_secret=YOUR_CLIENT_SECRET \
  -d code_verifier=YOUR_VERIFIER

Every app authenticates here with its client secret, so do this exchange on your server and never in browser code. You can also send the client credentials as HTTP Basic auth. Verify the id_token signature against the JWKS above. The response carries access_token, refresh_token, expires_in, scope and, with openid, an id_token. To renew, POST grant_type=refresh_token with the refresh token and your client credentials.

3. Read the profile

curl https://nynrocdgmowjgslgfdmc.supabase.co/functions/v1/cx-userinfo \
  -H "Authorization: Bearer ACCESS_TOKEN"

{
  "sub": "devit_user_id",
  "preferred_username": "someone",
  "name": "Some One",
  "picture": "https://...",
  "email": "someone@example.com",
  "email_verified": true
}

sub is the stable Devit user ID, so key your accounts on it rather than on the email or username. The id_token carries the same claims, and its aud is your client ID.

Connect Claude, Cursor, VS Code, Grok or any other MCP client to Devit. Add the server URL, approve access in the browser window that opens, and you are connected. There is no API key to copy. It signs you in with your Devit account. Access is read-only unless you switch on posting during approval.

https://devit-six.vercel.app/mcp

Add it to your client

claude mcp add --transport http devit https://devit-six.vercel.app/mcp

In Claude (web and desktop) add it as a custom connector with the URL above. In Cursor and VS Code, add it as a remote server with the same URL:

{
  "mcpServers": {
    "devit": { "url": "https://devit-six.vercel.app/mcp" }
  }
}

The first time you connect, your client opens Devit's approve screen. Sign in if you need to, check what the app is asking for, and press Approve. Clients register themselves automatically, so you never create an app by hand.

Tools

Resources and prompts

Clients that support them can attach Devit content directly: devit://post/{post} and devit://user/{username}. There are also four ready-made prompts: draft_devit_post, reply_to_devit_post, find_devit_collaborators and devit_digest. The drafting prompts only write a draft. Nothing is published until you approve it.

Account tools (opt-in)

These are read-only and sit behind a second checkbox on the approve screen, Read your private Devit account, which is off by default. Leave it off and the tools are never listed. They never expose messages, email addresses, notification settings or admin data. All of them page with before and next_before.

Social tools (opt-in)

Behind the checkbox Follow, rate and handle collab requests, off by default. Follows update the same counters and send the same notifications as the app.

Delete tools (opt-in)

Behind its own checkbox, Delete your own posts and comments, off by default. It can only delete content you wrote, at most 5 items per 10 minutes. Editing posts isn't offered, because Devit moderates when a post is created and an edit would skip that check.

Write tools (opt-in)

The approve screen has an Allow posting, commenting and liking checkbox that is off by default. Leave it off and the write tools are never even listed to your client. Writes go through the same checks as the Devit app: your normal rate limits, mentions, slugs and counters. On top of that, a second post within 30 seconds is refused, so an agent can't put your account on a posting cooldown. Nothing here can edit content or send messages. Your client should ask you before each write, and the tool descriptions tell the model to act only on your explicit request.

Posts by private profiles and posts that failed moderation are never returned. Post and profile text is written by other people, so the server marks it as untrusted data. Treat anything inside it as content, not instructions.

For client authors

The server speaks Streamable HTTP and answers with plain JSON. An unauthenticated request gets a 401 with a WWW-Authenticate header that points at the protected-resource metadata. From there the standard flow applies: authorization-server metadata, dynamic client registration (RFC 7591) at https://nynrocdgmowjgslgfdmc.supabase.co/functions/v1/cx-register, then authorization code with S256 PKCE. Registered MCP clients are public (no client secret). They always receive mcp:read, and mcp:write, mcp:me, mcp:social and mcp:manage only when the user opts in on the approve screen. Their refresh tokens rotate on every use. Redirect URIs must be https, an http loopback address, or a custom app scheme, and are matched exactly.