Authentication
Every model call is authenticated with an API key created on the Keys page of the console. Each protocol keeps its official SDK's convention:
| Protocol | Endpoints | Where the key goes |
|---|---|---|
| OpenAI-compatible | https://modelportal.ai/v1/* |
Header Authorization: Bearer YOUR_API_KEY |
| Anthropic-compatible | https://modelportal.ai/v1/messages and friends |
Header x-api-key: YOUR_API_KEY, or Authorization: Bearer YOUR_API_KEY |
| Gemini-compatible | https://modelportal.ai/v1beta/* |
Header x-goog-api-key: YOUR_API_KEY, query parameter ?key=YOUR_API_KEY, or Authorization: Bearer YOUR_API_KEY |
- The OpenAI and Anthropic APIs reject keys passed in the URL query string.
- If a Gemini request carries the key in more than one place, all copies must match or the request is rejected.
- The public model list under
/api/v1/*needs no auth; console endpoints use your login session and do not accept API keys.
When authentication fails
| HTTP | Code | Cause |
|---|---|---|
| 401 | invalid_api_key |
The key is missing, mistyped or revoked |
| 401 | key_inactive |
The key is paused or expired |
| 403 | key_restricted |
The model is not in the key's allowed models, or the source IP is not on the key's allowlist |
Keeping keys safe
- Use keys on the server only. Anyone can pull code out of a browser or mobile app; to call from a frontend, go through your own backend.
- Create separate keys per app or environment, give each allowed models and a spend limit, and disable just one when something goes wrong.
- If a key may have leaked, revoke it on the Keys page right away and create a new one; see API keys.