Authentication
How to send your key, which header each format expects, and how to keep keys safe.
Every request needs an API key created in your dashboard. Keys start with sk- and carry the permissions and balance of the account that made them.
Two headers, one key
The same key works in both formats — only the header name changes.
| Format | Endpoint | Header |
|---|---|---|
| Anthropic | /v1/messages | x-api-key: sk-... |
| Anthropic (alt) | /v1/messages | Authorization: Bearer sk-... |
| OpenAI | /v1/chat/completions | Authorization: Bearer sk-... |
The Anthropic format additionally expects a version header. Any Anthropic SDK sets it automatically:
-H "anthropic-version: 2023-06-01"Environment variables
Most tooling reads these rather than taking a key as an argument:
| Variable | Used by | Value |
|---|---|---|
ANTHROPIC_BASE_URL | Claude Code, Anthropic SDK | https://aiprimetech.io |
ANTHROPIC_AUTH_TOKEN | Claude Code | your sk- key |
ANTHROPIC_API_KEY | Anthropic SDK (Python/TS) | your sk- key |
OPENAI_BASE_URL | OpenAI SDK, LangChain, LiteLLM | https://aiprimetech.io/v1 |
OPENAI_API_KEY | OpenAI SDK | your sk- key |
Note the
/v1 suffix on OPENAI_BASE_URL but not on ANTHROPIC_BASE_URL. That asymmetry is in the official SDKs, not something we introduced — the OpenAI client appends paths to the base you give it, the Anthropic client appends /v1 itself. Getting this wrong is the single most common setup error.Key hygiene
- Create a separate key per machine or project so one can be revoked without disturbing the others.
- Never commit keys. Use environment variables or a secret manager; add
.envto.gitignore. - Keys are shown in full once. Rotate rather than trying to recover a lost key.
- A leaked key spends your balance. Revoke it in the dashboard immediately — revocation is instant.
- Prefer server-side calls. A key shipped in a browser bundle or mobile app is a public key.
Revoking and rotating
- Dashboard → API Keys.
- Create the replacement key first and deploy it.
- Delete the old key once traffic has moved. In-flight requests using it fail immediately after deletion.