# Authentication

> How to send your key, which header each format expects, and how to keep keys safe.

_Source: https://aiprimetech.io/docs/getting-started/authentication/ · Home > Docs > Getting started_

Every request needs an API key created in your dashboard. Keys start with `sk-` and carry the permissions and balance of the account that made them.


## Two headers, one key

The same key works in both formats — only the header name changes.

| Format | Endpoint | Header |
|---|---|---|
| Anthropic | `/v1/messages` | `x-api-key: sk-...` |
| Anthropic (alt) | `/v1/messages` | `Authorization: Bearer sk-...` |
| OpenAI | `/v1/chat/completions` | `Authorization: Bearer sk-...` |

The Anthropic format additionally expects a version header. Any Anthropic SDK sets it automatically:

```bash
-H "anthropic-version: 2023-06-01"
```


## Environment variables

Most tooling reads these rather than taking a key as an argument:

| Variable | Used by | Value |
|---|---|---|
| `ANTHROPIC_BASE_URL` | Claude Code, Anthropic SDK | `https://aiprimetech.io` |
| `ANTHROPIC_AUTH_TOKEN` | Claude Code | your `sk-` key |
| `ANTHROPIC_API_KEY` | Anthropic SDK (Python/TS) | your `sk-` key |
| `OPENAI_BASE_URL` | OpenAI SDK, LangChain, LiteLLM | `https://aiprimetech.io/v1` |
| `OPENAI_API_KEY` | OpenAI SDK | your `sk-` key |

> Note the `/v1` suffix on `OPENAI_BASE_URL` but not on `ANTHROPIC_BASE_URL`. That asymmetry is in the official SDKs, not something we introduced — the OpenAI client appends paths to the base you give it, the Anthropic client appends `/v1` itself. Getting this wrong is the single most common setup error.


## Key hygiene

- Create a **separate key per machine or project** so one can be revoked without disturbing the others.
- Never commit keys. Use environment variables or a secret manager; add `.env` to `.gitignore`.
- Keys are shown in full **once**. Rotate rather than trying to recover a lost key.
- A leaked key spends your balance. Revoke it in the dashboard immediately — revocation is instant.
- Prefer server-side calls. A key shipped in a browser bundle or mobile app is a public key.


## Revoking and rotating

1. Dashboard → **API Keys**.
2. Create the replacement key first and deploy it.
3. Delete the old key once traffic has moved. In-flight requests using it fail immediately after deletion.

- [Quickstart](https://aiprimetech.io/docs/getting-started/quickstart/) — Make the first call
- [API key configuration](https://aiprimetech.io/docs/guides/api-key-configuration/) — Per-tool placement of the key
- [Errors](https://aiprimetech.io/docs/api-reference/errors/) — What a 401 vs 402 means


---
_ClaudeAPIKey.dev is an independently operated, Anthropic-compatible API gateway. Not affiliated with Anthropic._