Authentication

API keys

Every gateway request requires an AnyPath API key. Create keys in Console -> API access.

For OpenAI-compatible endpoints, send it as:

Authorization: Bearer sk-your-api-key

For Anthropic-compatible /v1/messages requests, you can also use:

x-api-key: sk-your-api-key

For Gemini /v1beta requests, Google-style clients can also send the same AnyPath key with x-goog-api-key or ?key=....

Key lifecycle

1. Create the key in API access.
2. Copy it immediately; the full secret is shown only once.
3. Store it in a server-side secret manager or environment variable.
4. Rotate or revoke it from the Console when it is no longer needed.

• Never expose API keys in client-side code
• Never commit API keys to version control
• Use environment variables or a secret manager
• Rotate keys periodically
• Delete unused keys

Use an API key

curl https://api.anypath.dev/v1/responses \
  -H "Authorization: Bearer $ANYPATH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-4o-mini",
    "input": "Hello!"
  }'

import os
from openai import OpenAI

client = OpenAI(
    api_key=os.environ.get("ANYPATH_API_KEY"),
    base_url="https://api.anypath.dev/v1"
)

import OpenAI from 'openai';

const client = new OpenAI({
  apiKey: process.env.ANYPATH_API_KEY,
  baseURL: 'https://api.anypath.dev/v1'
});

Key controls

Route policy

Each API key uses either intelligent routing or a specified provider. A specified provider is a provider boundary, not one fixed provider key. Call GET /v1/models with the same key to see the models it can use.

RPM and TPM Limits

Your account tier sets account-level RPM/TPM through the user policy. API key limits can only narrow that account policy for a specific workload. The effective value also depends on the selected model, eligible credential routes, and upstream provider keys. Use Console, GET /v1/models, and rate-limit headers to see the current effective limit.

Usage Limits

You can set a daily, weekly, monthly, or forever usage limit on each API key:

Setting	Description
No Limit	Key can use available shared capacity
Fixed Limit	Key stops working after reaching the specified amount

Key prefix

All AnyPath API keys start with sk-.

Anthropic Compatibility

For the /v1/messages endpoint, the Anthropic-style header works as expected:

curl https://api.anypath.dev/v1/messages \
  -H "x-api-key: sk-your-api-key" \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "claude-sonnet-4-6",
    "max_tokens": 1024,
    "messages": [{"role": "user", "content": "Hello!"}]
  }'

Use Authorization: Bearer ... for supported API families such as /v1/responses, /v1/chat/completions, /v1/messages, /v1/images/generations, and Gemini /v1beta.

Error Responses

Status Code	Code	Description
401	auth_required	Missing Authorization header
401	auth_invalid	Invalid API key
401	auth_expired	API key has expired
403	spending_limit_exceeded	API key spending limit reached

At runtime the JSON type field is always identical to code. Example:

{
  "error": {
    "message": "Invalid API key.",
    "type": "auth_invalid",
    "code": "auth_invalid"
  }
}