Authentication and API keys

Every request to the API carries one secret key. The same key works for every model and for both the OpenAI and the Anthropic request formats, so one key per app or machine is enough.

Get a key

1. Sign in and open API keys in the console.
2. Choose Create key, give it a name (up to 50 characters) and, if you want, a spend limit, an expiry date or a model list. All three are optional and are explained below.
3. Copy the key from the dialog. It starts with sk-. The console shows the full key only once. If you lose it, revoke it and create a new one.

You can hold up to 1,000 keys per account. Name each key after the app, machine or teammate that uses it, so you can revoke one without breaking the others.

Send the key

The gateway accepts the key with or without the sk- prefix. Copying it exactly as the console shows it avoids mistakes.

# OpenAI format: Bearer token
curl https://api.oneaiapikey.com/v1/chat/completions \
  -H "Authorization: Bearer $RELAYKIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-5.6-terra", "messages": [{"role": "user", "content": "Hi"}]}'

# Anthropic format: x-api-key (Bearer works too)
curl https://api.oneaiapikey.com/v1/messages \
  -H "x-api-key: $RELAYKIT_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{"model": "claude-sonnet-5-5", "max_tokens": 256, "messages": [{"role": "user", "content": "Hi"}]}'

import os
from openai import OpenAI
import anthropic

# The SDK sends "Authorization: Bearer <key>"
openai_client = OpenAI(base_url="https://api.oneaiapikey.com/v1", api_key=os.environ["RELAYKIT_API_KEY"])

# The SDK sends "x-api-key: <key>"; no /v1 in the base URL
claude_client = anthropic.Anthropic(base_url="https://api.oneaiapikey.com", api_key=os.environ["RELAYKIT_API_KEY"])

import OpenAI from "openai";
import Anthropic from "@anthropic-ai/sdk";

const openai = new OpenAI({ baseURL: "https://api.oneaiapikey.com/v1", apiKey: process.env.RELAYKIT_API_KEY });

// No /v1 in the base URL: the SDK adds /v1/messages itself
const claude = new Anthropic({ baseURL: "https://api.oneaiapikey.com", apiKey: process.env.RELAYKIT_API_KEY });

Check that a key works

Listing models is free and is the quickest test. A working key returns HTTP 200 and the models it may call:

curl -s https://api.oneaiapikey.com/v1/models \
  -H "Authorization: Bearer $RELAYKIT_API_KEY"

A missing, mistyped, disabled, expired or used-up key returns the same response. The gateway does not say which of these it is, so check the key’s status in the console:

HTTP/1.1 401 Unauthorized
Content-Type: application/json
X-Request-Id: <request id>

{"error":{"code":"","message":"Invalid token (request id: <request id>)","type":"api_error"}}

Per-key settings

Set these when you create a key, or later with Edit on the API keys page.

Spend limit

The key stops working once it has spent this many dollars. Your account balance still applies on top, so a key never spends more than the account holds.

• While some limit is left but less than the gateway’s up-front estimate for a request, that request fails with HTTP 403 and the code pre_consume_token_quota_failed.
• Once the limit is fully used, the key returns 401 Invalid token, like a disabled key.

Raise the limit, or clear the field to remove it, and the key works again.

Expiry date

The key stops working at the end of that day, in your local time. After that it returns 401. Edit the key and pick a later date, or clear the field, to switch it back on.

Model list

Choose “Every model your account can use” (the default) or “Only the models I pick”. With a list, a request for any other model fails with HTTP 403 and the message This token has no access to model <id>, and GET /v1/models returns only the picked models.

Disable and revoke

Disable stops a key without deleting it; it returns 401 until you enable it again. Revoke deletes the key for good.

Store keys safely

• Keep keys in environment variables or a secrets manager, never in source code. The examples in these docs read RELAYKIT_API_KEY.
• Never put a key in a browser bundle, a mobile app or a public repository. Anyone who has it can spend your balance. Call the API from your server instead.
• Use one key per app, machine or teammate, with a spend limit on each, so a leak or a runaway loop costs at most that limit.
• Set an expiry date on keys for short projects, demos and contractors.

Rotate or revoke a key

1. Create a new key and deploy it alongside the old one.
2. Check the usage page. Once the old key shows no new requests, disable it.
3. Revoke the old key after a few days without problems.

If a key leaks, disable or revoke it straight away on the API keys page, then create a replacement.

Related

• Quickstart: your first request in curl, Python and Node.
• Cost control: spend limits, cheaper models and caching together.
• Errors: every 401 and 403 the API returns, with fixes.
• Account security and alerts: two-factor sign-in, IP allowlists and low-balance alerts.