Ghost sessions

A Ghost is an ephemeral session: a short-lived, scoped API key plus a purge contract. While the ghost is alive it works like any other key. When it is destroyed, or when it expires, the gateway revokes the key and purges the session's metadata: its usage rows, its receipts, its sandbox records.

Temporary, not anonymous. Sable's privacy contract already means prompts, completions, and submitted code are never stored for anyone, ghost or not. What a Ghost adds is that the session's metadata (which model, when, how many tokens, at what cost) is erased too, instead of persisting in your account history. It does not hide who you are: the session belongs to your account, and billing ledger amounts remain, because money is append-only.

Quickstart

Start a one-hour ghost with a $2 spend cap:

curl https://api.buildsable.com/v1/ghost/sessions \
-H "Authorization: Bearer $SABLE_SESSION_TOKEN" \
-H "Content-Type: application/json" \
-d '{"duration_secs": 3600, "spend_limit_usd": 2}'

{
  "id": "ghost_7f2a…",
  "status": "active",
  "expires_at": "2026-09-03T18:00:00Z",
  "api_key": "sk-sable_…",
  "api_key_id": "key_91…",
  "what_is_temporary": ["…"],
  "what_is_not": ["…"],
  "note": "The key is shown once. Temporary, not anonymous."
}

The api_key is shown exactly once. Use it like any sk-sable_ key for chat, embeddings, and sandboxes until the session ends.

Destroy it early:

curl -X POST https://api.buildsable.com/v1/ghost/sessions/$GHOST_ID/destroy \
-H "Authorization: Bearer $SABLE_SESSION_TOKEN"

Endpoints

All session-authed (Authorization: Bearer sess_…).

What is erased, and what is not

When a ghost is destroyed or expires:

• Erased: the session's usage rows, its receipts, and its sandbox records. The metadata trail of what the ghost did is purged immediately and becomes inaccessible at once. Provider backups age out on the operator's retention schedule.
• Not erased: billing ledger amounts. The credit ledger is append-only by design (that is what makes balances auditable), so what the session spent remains as amounts in the ledger.
• Never stored in the first place: prompts, completions, and submitted code. That is the §3 privacy contract and it applies to every request on Sable, ghost or not.

A Ghost is a privacy convenience inside your own account history. It is not an identity feature: the session is created by your account, billed to your account, and subject to the same acceptable-use obligations as everything else.

Limits

• duration_secs: 300 to 86400 (5 minutes to 24 hours); default 3600.
• Extensions are allowed, but total lifetime is capped at 24 hours.
• spend_limit_usd is optional and works like any key spend cap.
• Destroyed and expired sessions cannot be revived; start a new one.