Authentication & API keys
How to send your API key, and how to limit what each key can do.
Every request carries one of your API keys. Create and manage keys on the console's API Keys page.
Sending the key
| Endpoint | Header |
|---|---|
| All endpoints | Authorization: Bearer sk-... |
/v1/messages (Anthropic format) | x-api-key: sk-... also works |
The official SDKs set the right header for you when you pass api_key / apiKey.
Treat keys like passwords. Keep them in environment variables or a secret manager, never in client-side code or a public repository. If a key leaks, delete it in the console and create a new one.
Key limits
Click New key on the console's API Keys page, or Edit next to an existing key, to set its Limits. Each of the four limits has a switch: off means no limit, on lets you set a value. Changes take effect immediately.
| Limit | What it does |
|---|---|
| Expiration | Pick 7 days, 30 days, 90 days, 1 year, or Custom to choose a date. The key stops working at 23:59 local time on that day, and requests return 401. |
| Spending limit | An amount in US dollars. Once the key has spent this much it stops working, and requests return 401. When you edit a key, this is what it has left to spend, and changing it resets that amount. |
| Allowed models | Pick models from the catalog, or type a model ID that isn't listed, up to 50. Calls to any other model return 403. |
| IP allowlist | One IP address or CIDR range per line, up to 20. Requests from any other address return 403. |
When you edit a key, Expiration and Spending limit stay as they are unless you change them. In the key list, the Budget column shows what each key has left and has spent, and Status shows Expired or Budget used up once a key hits one of these limits. A spending limit never lets a key spend more than your account balance.
One key per app
Give each application, environment or teammate its own key. You can then see its spend in the key list, cap it with a spending limit and delete it without touching anything else.