# Authentication

> Which header each API format uses for your key, and whether its base URL includes /v1.

Every request is authenticated with an API key from the console. Which header carries it, and whether the base URL includes /v1, depends on the API format.

## Headers by format

Keep the header the official SDK of each format already sends; only the base URL and the key change.

| Format | Header | Base URL | Endpoints |
| --- | --- | --- | --- |
| OpenAI | `Authorization: Bearer sk-...` | `https://api.relayvia.dev/v1` | `/v1/chat/completions, /v1/responses, /v1/models` |
| Anthropic | `x-api-key: sk-...` | `https://api.relayvia.dev` | `/v1/messages` |
| Gemini | `x-goog-api-key: sk-...` | `https://api.relayvia.dev` | `/v1beta/models/{model}:generateContent` |

`Authorization: Bearer` also works on the Anthropic and Gemini endpoints.

## Base URL

OpenAI SDKs and tools take `https://api.relayvia.dev/v1`, with /v1. Anthropic SDKs, Claude Code and Gemini SDKs take `https://api.relayvia.dev`, without /v1: they add /v1 or /v1beta to the path themselves.

> **Warning**
>
> Adding /v1 to an Anthropic or Gemini base URL doubles it (for example /v1/v1/messages) and returns 404.

## Examples

**OpenAI**

```bash
curl https://api.relayvia.dev/v1/models \
  -H "Authorization: Bearer sk-..."
```

**Anthropic**

```bash
curl https://api.relayvia.dev/v1/messages \
  -H "x-api-key: sk-..." \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{"model":"claude-opus-5","max_tokens":1024,"messages":[{"role":"user","content":"Hello!"}]}'
```

**Gemini**

```bash
curl https://api.relayvia.dev/v1beta/models/gemini-3.6-flash:generateContent \
  -H "x-goog-api-key: sk-..." \
  -H "Content-Type: application/json" \
  -d '{"contents":[{"role":"user","parts":[{"text":"Hello!"}]}]}'
```

## Key in the URL (Gemini)

For compatibility with Gemini SDKs, the Gemini endpoints also accept `?key=sk-...`. Prefer the `x-goog-api-key` header: URLs end up in proxy logs and browser history more easily than headers.

## What a key can access

An API key belongs to your account and the team member who created it. Team members manage their own keys; admins manage every key in the account. Each key can have a credit limit and reset period, allowed models and an IP allowlist.

## Keep your key safe

Never put a key in source code or commit it; use environment variables. If a key leaks, disable it in the console right away and create a new one.

## Request ID

Every response, success or error, carries an `x-robi-request-id` header that matches the entry in the console's usage logs. Include it when you report a problem.