# Authentication & API keys (/docs/concepts/authentication)

How to send your API key, and how to limit what each key can do.



Every request carries one of your API keys. Create and manage keys on the console's [API Keys](https://console.cheapaimodel.ai/keys) page.

## Sending the key [#sending-the-key]

| Endpoint                          | Header                         |
| --------------------------------- | ------------------------------ |
| All endpoints                     | `Authorization: Bearer sk-...` |
| `/v1/messages` (Anthropic format) | `x-api-key: sk-...` also works |

The official SDKs set the right header for you when you pass `api_key` / `apiKey`.

<Callout type="warn">
  Treat keys like passwords. Keep them in environment variables or a secret manager, never in client-side code or a public repository. If a key leaks, delete it in the console and create a new one.
</Callout>

## Key limits [#key-options]

Click **New key** on the console's [API Keys](https://console.cheapaimodel.ai/keys) page, or **Edit** next to an existing key, to set its **Limits**. Each of the four limits has a switch: off means no limit, on lets you set a value. Changes take effect immediately.

| Limit          | What it does                                                                                                                                                                                       |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Expiration     | Pick 7 days, 30 days, 90 days, 1 year, or Custom to choose a date. The key stops working at 23:59 local time on that day, and requests return `401`.                                               |
| Spending limit | An amount in US dollars. Once the key has spent this much it stops working, and requests return `401`. When you edit a key, this is what it has left to spend, and changing it resets that amount. |
| Allowed models | Pick models from the catalog, or type a model ID that isn't listed, up to 50. Calls to any other model return `403`.                                                                               |
| IP allowlist   | One IP address or CIDR range per line, up to 20. Requests from any other address return `403`.                                                                                                     |

When you edit a key, Expiration and Spending limit stay as they are unless you change them. In the key list, the **Budget** column shows what each key has left and has spent, and **Status** shows **Expired** or **Budget used up** once a key hits one of these limits. A spending limit never lets a key spend more than your account balance.

## One key per app [#one-key-per-app]

Give each application, environment or teammate its own key. You can then see its spend in the key list, cap it with a spending limit and delete it without touching anything else.