Authentication & API keys

Send a bearer token

Pass your Router API key in the Authorization header. OpenAI clients set this header when you provide their api_key or apiKey option.

1Authorization: Bearer $ROUTER_API_KEY

Create and store a key

Create a key in API keys. The secret is shown once. Store it in your server environment and give each application a recognizable key name.

Paid inference is disabled on each key until you explicitly enable it in API keys. Disabling it blocks new paid requests from that key; requests already accepted may finish and charge accepted provider-reported usage. The Playground uses your signed-in account and confirms its 5-credit request maximum once per session.

You can also set a lower monthly credit limit for an individual paid key. Leave it blank to use only the shared account limit. Key limits reset at the start of each UTC month; they do not increase the account's 100-credit allowance.

Keys expire after 90 days. An account can keep at most 10 active keys. The dashboard shows the key prefix, creation and expiry times, last use when available, and whether the key has been revoked.

Revoke access

Revoke a key from the dashboard when an application no longer needs it or a secret has been exposed. Create a replacement and update your server configuration. Revoked credentials cannot authorize new requests.

Revocation is checked on every new request. A request that is already running may finish, so rotate the application secret before revoking when you want a clean handover.

Account limits

By default, an account can make 60 model or chat requests per minute and run 2 inference requests at once. These limits are shared across all API keys and signed-in account tokens. A 429 response includes retry guidance.

Router also starts with a 100-credit spending cap per UTC calendar month and a 5-credit maximum per request. Pending reservations count against the monthly cap until they settle or release. Available shared balance is a separate limit; earning or adding credits does not itself raise the Router cap.

Where keys work

Application keys authorize GET /v1/models, POST /v1/chat/completions, and owner-scoped receipt lookup at GET /v1/credits/requests/{request_id}. Receipt lookup also accepts a signed-in Network account token; either credential can read only its account's requests. Public provider discovery requires no authentication; profile and offer management require your signed-in Network account. Provider management, key administration, and usage-history endpoints require a signed-in Network account and are not part of the public application-key surface.

Dashboard and application access

The Playground uses your signed-in account. Application requests use API keys. Playground requests are not included in the API-key usage history.

Continue with your first request.