> For the complete documentation index, see [llms.txt](https://anyint.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://anyint.gitbook.io/docs/authentication-and-keys/api-keys.md).

# api keys

API keys are the main way applications authenticate to AnyInt. Treat every key as a production secret, even if it only targets a low-cost or development environment.

## Core rules

* treat the key as a server-side secret
* rotate keys when ownership changes
* use separate keys for development, staging, and production
* revoke and recreate keys immediately if exposure is suspected

## Common header styles

Use the header style required by the endpoint family:

```http
Authorization: Bearer <ANYINT_API_KEY>
```

or

```http
x-api-key: <ANYINT_API_KEY>
```

Anthropic-compatible routes additionally require:

```http
anthropic-version: 2023-06-01
```

## Subscription key behavior

Subscription-backed keys follow a strict lifecycle:

* the plain key is returned only once when it is created or regenerated
* later views should show a masked key only
* regenerating a key should invalidate the old key immediately
* an expired subscription should invalidate its key automatically

The current subscription product design also distinguishes plan and custom keys by prefix, such as `sk-plan-*` and `sk-custom-*`.

## How keys relate to billing

Depending on your account configuration, requests made with your API key may be charged against:

* prepaid Pay As You Go balance
* a plan subscription
* a custom subscription

That means key management and billing mode are connected. When you rotate or regenerate a key, make sure the environments using it are also aligned with the intended billing model.

## Storage and handling guidance

* never expose keys in browser code
* store keys in a secret manager or deployment platform env var
* tag keys by workload when possible
* keep the visible prefix in your internal runbooks so operators can identify which key is being used

## Example environment setup

```bash
export ANYINT_API_KEY="your-anyint-api-key"
```

Then use it in requests:

```bash
curl https://gateway.api.anyint.ai/openai/v1/chat/completions \
  -H "Authorization: Bearer $ANYINT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"openai/gpt-4o","stream":false,"messages":[{"role":"user","content":"hello"}]}'
```

## Common mistakes

* reusing one key across dev, staging, and production
* storing secrets in frontend apps
* forgetting that some routes use `x-api-key` rather than `Authorization: Bearer`
* regenerating a key without updating every dependent environment