# Authentication

Every API request is authenticated with an API key sent as a bearer token.

## API keys

Keys are created in the dashboard under [API keys](https://claudech.com/api-keys). Each key:

- starts with `sk-` followed by 48 random characters;
- is shown **once** at creation. Claudech stores only a SHA-256 hash, so a lost key must be rotated, not recovered;
- can be named, given an expiry date, rotated and revoked at any time;
- inherits the plan, balance and rate limits of the account that owns it.

The number of active keys per account depends on your plan (5 on pay-as-you-go and Starter, 20 on Pro and more above). Expired or revoked keys are rejected with `401 invalid_api_key`.

## Sending the key

Pass the key in the `Authorization` header using the `Bearer` scheme:

```http
POST /v1/chat/completions HTTP/1.1
Host: api.claudech.com
Authorization: Bearer sk-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Content-Type: application/json
```

**curl**

```bash
curl https://api.claudech.com/v1/models \
  -H "Authorization: Bearer $CLAUDECH_API_KEY"
```

**JavaScript**

```javascript
import OpenAI from 'openai';

const client = new OpenAI({
  apiKey: process.env.CLAUDECH_API_KEY,
  baseURL: 'https://api.claudech.com/v1',
});
```

**Python**

```python
import os
from openai import OpenAI

client = OpenAI(api_key=os.environ["CLAUDECH_API_KEY"], base_url="https://api.claudech.com/v1")
```

Requests without a key, or with a malformed one, receive `401` with `code: "missing_api_key"` or `code: "invalid_api_key"`. See [Errors](https://claudech.com/docs/errors).

### `x-api-key` header

Anthropic-style clients send the key in an `x-api-key` header instead of `Authorization`. Claudech accepts both on every endpoint, so the Anthropic SDKs, Claude Code and tools with an "Anthropic base URL" setting work as-is. See [SDKs & libraries](https://claudech.com/docs/sdks#anthropic-sdks-and-claude-code).

```http
POST /v1/messages HTTP/1.1
Host: api.claudech.com
x-api-key: sk-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
anthropic-version: 2026-11-08
Content-Type: application/json
```

## Account requirements

Beyond a valid key, a request is accepted only if the owning account is in good standing:

| Condition | Result |
| --- | --- |
| Email address not verified | `403 email_not_verified` |
| Account suspended or pending deletion | `403 account_inactive` |
| Account, key or network on the blocklist | `403 account_blocked`, `api_key_blocked`, `ip_blocked` |
| Balance below the minimum reservation | `402 insufficient_balance` |
| Model not included in your plan | `403 model_not_in_plan` |
| Platform in maintenance mode | `503 maintenance_mode` |

## Key management over the API

You can list your keys with `GET /v1/api-keys` using any key. Creating, rotating and revoking keys, however, is **only** possible from a signed-in dashboard session, never from another API key. This limits the damage a leaked key can do: it cannot mint new credentials for itself. See the [API keys reference](https://claudech.com/docs/api/api-keys).

## Keeping keys safe

> **Never ship a key to a browser or mobile app**
>
> Anything you send to a client can be extracted. Call Claudech from your own backend and let your clients talk to you.

- Load keys from environment variables or a secret manager; keep them out of source control.
- Use **one key per application or environment** so you can rotate or revoke without collateral damage and attribute usage on the [Usage](https://claudech.com/usage) page.
- Set an **expiry date** on keys used for experiments and CI jobs.
- Rotate immediately if a key may have leaked: **Rotate** creates a replacement and revokes the old key in a single step, and the audit trail records both events.
- Watch for `x-claud-balance` dropping unexpectedly or unfamiliar requests in your usage log; they are the fastest signals of a compromised key.

If you believe a key has been exposed and you cannot reach the dashboard, open a ticket from [Support](https://claudech.com/support) and we will revoke it for you.

---

Source: https://claudech.com/docs/authentication