Kimi (Moonshot K2)

Kimi is Moonshot AI's K2 model family. Its API is OpenAI Chat Completions–compatible, so Sentisec carries it on the same wire as OpenAI with the upstream swapped to api.moonshot.ai/v1 — any OpenAI-shaped client works unchanged.

Model ids beginning kimi- or moonshot- route to Kimi automatically.

Setup

Get a Moonshot key from platform.kimi.ai. Vendor docs sometimes call it MOONSHOT_API_KEY — same value, different name.

Add it to your workspace. In the dashboard, open Settings → Providers. Under Provider keys, choose Add Kimi K2 key, paste the key, and click Save credential. It is encrypted before storage — see keys management.

Mint a Sentisec API key. Settings → API keys → Issue key. Format: sk_sentisec_<8>_<32>.

Point your client at your workspace endpoint.

export OPENAI_BASE_URL=https://api.sentisec.ch/ws/<your-workspace-id>/v1
export OPENAI_API_KEY=$SENTISEC_API_KEY

Warning

The workspace id in the URL is load-bearing

Use the workspace-scoped base URL. It is the form that guarantees your workspace's own policy travels with every request, on every transport. Your workspace id is on the dashboard next to your API key.

First call

A kimi- model id is enough — no header needed:

curl -X POST https://api.sentisec.ch/ws/<your-workspace-id>/v1/chat/completions \
  -H "Authorization: Bearer $SENTISEC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "kimi-k2.7-code",
    "messages": [{"role": "user", "content": "hi"}]
  }'

If you use an alias or a model name the prefix does not cover, pin the provider explicitly instead:

curl -X POST https://api.sentisec.ch/ws/<your-workspace-id>/v1/chat/completions \
  -H "Authorization: Bearer $SENTISEC_API_KEY" \
  -H "X-Sentisec-Upstream-Provider: kimi" \
  -H "Content-Type: application/json" \
  -d '{"model":"kimi-k2.7-code","messages":[{"role":"user","content":"hi"}]}'

The header wins over the model id, and Sentisec strips it before forwarding — Moonshot never sees it.

OpenAI SDKs

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.sentisec.ch/ws/<your-workspace-id>/v1",
    api_key=os.environ["SENTISEC_API_KEY"],
    default_headers={"X-Sentisec-Upstream-Provider": "kimi"},
)

resp = client.chat.completions.create(
    model="kimi-k2.7-code",
    messages=[{"role": "user", "content": "hi"}],
)

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://api.sentisec.ch/ws/<your-workspace-id>/v1",
  apiKey: process.env.SENTISEC_API_KEY!,
  defaultHeaders: { "X-Sentisec-Upstream-Provider": "kimi" },
});

const resp = await client.chat.completions.create({
  model: "kimi-k2.7-code",
  messages: [{ role: "user", content: "hi" }],
});

Running Sentisec yourself? Substitute your own base URL for https://api.sentisec.ch — see enterprise access.

Recommended client — opencode

The quickest Kimi setup is the opencode CLI agent together with the dashboard's Settings → Connect wizard, which generates a ready-to-paste ~/.config/opencode/opencode.json block with the base URL, the provider header, and the model already filled in.

Model ids

Model id	What it is
`kimi-k2.7-code`	The default. Purpose-built coding model, thinking always on, 256k context — at the same price as general-purpose K2.6, which makes it the better pick for an agentic coding CLI.
`kimi-k3`	Frontier tier for hard problems: 1M context and `reasoning_effort` control, at roughly 3× the input and 4× the output price. The model you escalate to.
`kimi-k2.7-code-highspeed`	The same 256k-context coding model at markedly higher throughput, for about twice the price.
`kimi-k2.6`	The cheapest of the four. Hybrid thinking that can be switched off for cheap non-reasoning turns.

Warning

Moonshot spells these ids with a dot

kimi-k2.6, not kimi-k2-6. The hyphen form is not a valid id and the upstream rejects it. Earlier ids you may still have in a config — kimi-latest, moonshot-v1-32k, moonshot-v1-8k — have been discontinued or are on the way out; move to one of the four above.

Sentisec does not maintain an allowlist: any id starting with kimi- or moonshot- is forwarded to Moonshot, which is the source of truth for what is available. If Moonshot returns model_not_found, you get its error body intact. The table above is what appears in model discovery (GET .../v1/models).

If something goes wrong

Response	What it means
`401 no_upstream_credential`	No Kimi key is stored on this workspace. In the dashboard, the request's row under Requests shows No provider key with an Add Kimi K2 key action that opens Settings → Providers with Kimi selected under Provider keys; the direct link is `/w/<workspace-id>/settings/upstreams?provider=kimi`.
A `401` from Moonshot	Your Moonshot key was revoked or is out of quota at the vendor. Replace it under Settings → Providers, in Provider keys.
`400 upstream_provider_header_invalid`	The `X-Sentisec-Upstream-Provider` value is not a known provider name — check the spelling.
Request went to OpenAI instead	Your model id does not start with `kimi-` or `moonshot-`. Send the header.

More: Provider unavailable.