How does API Key authentication work?

OpenAI-compatible endpoints use Authorization: Bearer; Claude Messages also accepts x-api-key, while Gemini v1beta uses x-goog-api-key.

Steps

1. Copy the key from the console.
2. Put it in the protocol-specific header, not the query string.
3. Verify with Models or a small request before deployment.

Limits and exceptions

401 usually means missing or invalid credentials; 403 may indicate permission, model, or policy restrictions. Do not expose long-lived keys in browser code.