Authentication and API keys

Create an API key

1. Sign in, open the API Keys page of the console and give the key a name that says what it is for.
2. Set any limits you want (requests per minute, budgets, allowlists); you can change them later.
3. The new key appears in the list; click Copy to get the full key (it starts with sk-) and keep it somewhere safe, such as an environment variable on your server.

Manage API keys →

Send the key with each request

OpenAI-compatible endpoints take an Authorization: Bearer header; the Anthropic endpoints take x-api-key and also accept Authorization: Bearer. Keep the key in an environment variable, not in your code.

Authorization: Bearer YOUR_API_KEY

x-api-key: YOUR_API_KEY
anthropic-version: 2023-06-01

import os
from openai import OpenAI

# export NEZHAGATE_API_KEY=sk-...   (never commit the key)
client = OpenAI(base_url="https://nezhagate.com/v1", api_key=os.environ["NEZHAGATE_API_KEY"])

Put limits on a key

Each key can have its own limits, independent of the others:

What you get back when a limit is hit →

Disable and rotate

1. Create a new key and switch your code over to it.
2. Once the new key is working, disable the old one in the console. It takes effect at once; requests with the old key then get 401.
3. If you think a key leaked, disable it first, then create a new one.

Keeping keys safe

• Keep keys on your server. Never put them in a web page, an app or a public repository.
• Use a separate key per app and per environment, so a problem means disabling just that one.
• Give keys used by automation or third-party tools a budget or total limit.
• If your servers have fixed IPs, turn on the IP allowlist.

The balance belongs to the account

All keys of an account share one balance. GET /v1/usage with any key returns the account's balance and spend.