# Model router and project keys

Use this document when an application needs to call models. Account-level agent access uses `core_mk_`; application code uses a project-scoped `core_sk_`.

## Create a project key

Run the key flow locally. The key is injected without being printed.

```sh
npx @core-so/login key create --project weather-app
npx @core-so/login key run --project weather-app -- npm test
```

`key run` exposes `CORE_API_KEY` only to the child process. Never put a Core key in source code, browser JavaScript, logs, or an AI transcript.

## Call a model

```sh
curl -s https://router.core.so/v1/model/messages \
  -H "Authorization: Bearer $CORE_API_KEY" \
  -H "content-type: application/json" \
  -d '{
    "model": "claude-sonnet-5",
    "max_tokens": 1024,
    "messages": [{"role":"user","content":"Hello"}]
  }'
```

## Request rules

| Field or header | Rule |
|---|---|
| `model` | Use a model id returned by Core. |
| `max_tokens` | Required. Requests above the per-call spend ceiling are rejected before dispatch. |
| `stream` | Optional boolean. Usage and cost are returned in-band when streaming. |
| `x-core-cost-micro` | Observed cost in micro-dollars. |

Count tokens before a large request:

```sh
curl -s https://router.core.so/v1/model/count_tokens \
  -H "Authorization: Bearer $CORE_API_KEY" \
  -H "content-type: application/json" \
  -d '{"model":"claude-sonnet-5","messages":[{"role":"user","content":"Hello"}]}'
```

## Related

- [Account access](https://docs.core.so/mcp-account-access.md)
- [Billing and credits](https://docs.core.so/billing-and-credits.md)
- [Build](https://build.core.so)