Authentication

Every endpoint requires an API key. Most routes use OpenAI-style Bearer auth; the native Claude and Gemini protocols use their own headers. One key works across all protocols and all endpoints.

1. Get a key

sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

When creating it you pick a routing mode (by vendor / by model / all models and vendors) that decides which models the key can call — see API keys & routing.

Keep it secret

A key spends your balance. Never put it in front-end code, public repositories or end-user builds. If you suspect a leak, delete and recreate it immediately; IP allow-lists, expiry dates and quota caps on the key reduce the blast radius.

2. Default: Bearer token

All OpenAI-compatible routes (/v1/chat/completions, /v1/responses, /v1/images/*, /v1/embeddings — everything under /v1/*) use:

Authorization: Bearer sk-xxxxxxxx

The official OpenAI SDK adds this header for you from api_key.

3. Claude native: x-api-key

For the Anthropic protocol (POST /v1/messages), the Anthropic SDK and Claude Code, send:

x-api-key: sk-xxxxxxxx
anthropic-version: 2023-06-01

As environment variables: ANTHROPIC_BASE_URL=https://cn.chatapi.app and ANTHROPIC_API_KEY=sk-xxxxxxxx (Claude Code also accepts ANTHROPIC_AUTH_TOKEN). The route also accepts Authorization: Bearer. See Claude Messages.

4. Gemini native: x-goog-api-key

For the Gemini protocol (/v1beta/*) or the Google GenAI SDK:

x-goog-api-key: sk-xxxxxxxx

The query parameter ?key=sk-xxxxxxxx works too. See Gemini native.

5. Header cheat sheet

Protocol / path	Auth header	SDK environment
OpenAI-compatible `/v1/*`	`Authorization: Bearer sk-...`	`OPENAI_API_KEY` + `OPENAI_BASE_URL=https://cn.chatapi.app/v1`
Claude `/v1/messages`	`x-api-key: sk-...` + `anthropic-version`	`ANTHROPIC_API_KEY` + `ANTHROPIC_BASE_URL=https://cn.chatapi.app`
Gemini `/v1beta/*`	`x-goog-api-key: sk-...`	`GEMINI_API_KEY` + `GOOGLE_GEMINI_BASE_URL=https://cn.chatapi.app`
Jev `/v1/decisions`	`Authorization: Bearer sk-...`	—

6. Auth failures

A missing or invalid key returns 401:

{
  "error": {
    "code": "",
    "message": "Invalid token (request id: ...)",
    "type": "new_api_error"
  }
}

Status	Typical cause	Fix
`401`	Typo, deleted or expired key, caller IP not on the allow-list	Check the key's status and allow-list in the console
`403`	The key's routing mode excludes that model / vendor, or the model was retired	Use an "all models" key or tick the model under "by model"; `GET /v1/models` shows what the key can reach
`429`	Insufficient balance, key quota exhausted or concurrency exceeded	Top up / raise the quota / reduce concurrency