API Keys

API keys are the main way applications authenticate to AnyInt. Treat every key as a production secret, even if it only targets a low-cost or development environment.

Core rules

treat the key as a server-side secret
rotate keys when ownership changes
use separate keys for development, staging, and production
revoke and recreate keys immediately if exposure is suspected

Common header styles

Use the header style required by the endpoint family:

Authorization: Bearer <ANYINT_API_KEY>

x-api-key: <ANYINT_API_KEY>

Anthropic-compatible routes additionally require:

anthropic-version: 2023-06-01

Subscription key behavior

Subscription-backed keys follow a strict lifecycle:

the plain key is returned only once when it is created or regenerated
later views should show a masked key only
regenerating a key should invalidate the old key immediately
an expired subscription should invalidate its key automatically

The current subscription product design also distinguishes plan and custom keys by prefix, such as sk-plan-* and sk-custom-*.

How keys relate to billing

Depending on your account configuration, requests made with your API key may be charged against:

prepaid Pay As You Go balance
a plan subscription
a custom subscription

That means key management and billing mode are connected. When you rotate or regenerate a key, make sure the environments using it are also aligned with the intended billing model.

Storage and handling guidance

never expose keys in browser code
store keys in a secret manager or deployment platform env var
tag keys by workload when possible
keep the visible prefix in your internal runbooks so operators can identify which key is being used

Example environment setup

export ANYINT_API_KEY="your-anyint-api-key"

Then use it in requests:

curl https://api.anyint.ai/openai/v1/chat/completions \
  -H "Authorization: Bearer $ANYINT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"claude-sonnet-4-6","stream":false,"messages":[{"role":"user","content":"hello"}]}'

Common mistakes

reusing one key across dev, staging, and production
storing secrets in frontend apps
forgetting that some routes use x-api-key rather than Authorization: Bearer
regenerating a key without updating every dependent environment