Inference API keys authenticate data-plane HTTP calls. They are not the same as console login sessions.
Control-plane OpenAPI (key management, usage queries, etc.) uses separate access tokens (
ot_prefix). See OpenAPI overview. This page covers inference keys (sk-).
How to obtain a key
Create a tenant inference key in the RouterBrain console (UI path depends on your deployment). The plaintext secret is shown once — store it in your secret manager immediately.
OpenAI-compatible surface
Authorization: Bearer YOUR_API_KEY
Required for authenticated /v1/* endpoints (chat, embeddings, files, speech, etc.).
GET /v1/models does not require a key (public catalog).
Anthropic-compatible surface
Either (prefer the first):
x-api-key: YOUR_API_KEY
or
Authorization: Bearer YOUR_API_KEY
Required for /anthropic/v1/messages and /anthropic/v1/models.
Keys and tenancy
- Each key resolves to a tenant context for model entitlements, balance, IP policy, etc.
- See Errors for 401/403 semantics.
Do not
| Anti-pattern | Do instead |
|---|---|
| Embed production keys in front-end code | Proxy via BFF / server |
| Commit keys to Git | Env vars + secret manager |
| Share one key across unrelated systems | Separate keys per service/env |
See Security best practices and Key lifecycle.