Guides
Authentication
Every request is authenticated with an API key. Each protocol uses its own customary header, but they all take the same key.
Create an API key
On the console's API keys page, click "Create key". Keys start with sk-; copy and store it as soon as it's created. You can create as many keys as you like, for example one per project, environment or teammate, so each can be limited and revoked on its own.
Send the key with each request
| Protocol | Header | Example |
|---|---|---|
| OpenAI compatible | Authorization | Authorization: Bearer sk-... |
| Anthropic native | x-api-key (Authorization: Bearer also works) | x-api-key: sk-... |
| Gemini native | Authorization: Bearer or x-goog-api-key | x-goog-api-key: sk-... |
The official SDKs send the right header for you; just pass them the key:
Python
from openai import OpenAI
client = OpenAI(api_key="sk-...", base_url="https://api.flyrouter.ai/v1")Limit what a key can do
When editing a key you can set the limits below. Requests outside them are rejected and never billed:
- Spending limit: the most this key can spend; it stops when the limit is reached. Useful for teammates and third-party tools.
- Expiry: the key stops working after this date.
- Allowed models: only these models can be called; anything else returns 403.
- IP allowlist: only requests from these IPs or ranges are accepted.
Give tools like Claude Code and Cursor their own key with a spending limit. If a config file ever leaks, the damage is capped.
Security tips
- Treat a key like a password. Use it only on servers or your own machine, and never put it in frontend code, app bundles or public repositories.
- Store keys in environment variables or a secrets manager, not in source code.
- If you suspect a leak, delete the key in the console and create a new one. A deleted key stops working immediately.
Troubleshooting authentication
If you get a 401, check in this order:
- The key was copied in full (starts with
sk-, no leading or trailing spaces or newlines). - The header matches the protocol; for example, the Anthropic protocol uses
x-api-key. - The key hasn't been deleted, disabled or expired. You can check its status in the console.
- The base URL is right: the OpenAI SDK includes
/v1; the Anthropic and Gemini SDKs don't.
FlyRouter