Authentication
The proxy has two auth layers. Do not mix them up.
API keys (inference)
All /v1/* inference routes, MCP management, and most machine-to-machine calls take:
Authorization: Bearer sk-your-api-key-hereCreate and revoke keys at API Keys. Each key is a sk- prefix plus 48 hex characters. We store SHA-256 of the secret, not the secret itself. If you lose it, mint a new one.
Keys are scoped to your account. Partner child keys look the same on the wire; spend is billed to the parent.
JWT (dashboard)
The website uses a session JWT for /api/auth/me, keys, usage, settings, and partner routes. That token is not an inference key. SDKs should use sk-…, not the cookie.
Public routes (no auth)
These do not need a key:
| Method | Path | Purpose |
|---|---|---|
| GET | /health | Liveness |
| GET | /v1/models | OpenAI model list |
| GET | /api/models/capabilities | Live capability sheet |
| GET | /api/pricing | Live USD rates |
| GET | /api/status | Public status payload |
Common mistakes
- Sending the JWT to
/v1/chat/completions→ 401 - Reusing a revoked key → 401
- Putting the key in a query string or a public repo
- Expecting Chat MCP servers to work on the API before Settings → MCP tools is on
OAuth apps use a different token (oat_…). See Login with proxy.gonka.gg.