API Authentication
How to use Bearer API keys and understand key security controls.
The gateway accepts API keys through the Authorization header. Browser session tokens do not replace API keys for OpenAI-compatible endpoints.
Before routing, the backend checks key status, expiration, scopes, API/model permissions, IP/domain restrictions, and the subscription.
Key points
- Required header: Authorization: Bearer YOUR_API_KEY.
- Revoked, disabled, or expired keys are rejected by the backend.
- Key lists return only a masked prefix; no endpoint retrieves the secret.
- Rotation creates a new secret and invalidates the old one transactionally.