Get started

Authentication

How AZRouter API keys work and which headers carry them.

Every request carries one AZRouter API key.

API keys

Format	`sk-...`	51 characters: `sk-` and 48 letters or digits.
Shown	Once	At creation. Copy it then; it can't be shown again.
Scope	Your account	All keys on an account share its credits and rate limits.
Revoke	Any time	In Dashboard → API keys. A revoked key gets 401.

Headers

Send the key as a bearer token. This works on every endpoint, including /v1/messages.

Shell

curl https://api.azrouter.dev/v1/models \
  -H "Authorization: Bearer $AZROUTER_API_KEY"

Anthropic clients send the key in x-api-key instead. AZRouter accepts that header on /v1/messages:

Shell

curl https://api.azrouter.dev/v1/messages \
  -H "x-api-key: $AZROUTER_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{"model": "qwen/qwen3.8-flash", "max_tokens": 200, "messages": [{"role": "user", "content": "Reply with exactly: Hello from AZRouter"}]}'

A missing or wrong key

The gateway answers 401. The same 401 comes back for a revoked key, a key that reached its own spending limit, and a key switched off at your tier's monthly cap.

Shell

curl https://api.azrouter.dev/v1/models \
  -H "Authorization: Bearer sk-not-a-real-key"

JSON

{"error":{"code":"","message":"Invalid token (request id: ...)","type":"new_api_error"}}

Keep keys on the server

Never ship a key inside a browser or mobile app. Anyone who reads it can spend your credits.