Every request needs your RouterPlex API key. OpenAI-compatible clients normally send it as a bearer token:
text
Authorization: Bearer sk-...
Anthropic-compatible clients normally send the same key in x-api-key:
text
x-api-key: sk-...
Both authentication styles work on /v1/messages. Use the default header produced by your SDK.
Keys are created and managed in the dashboard.
Key hygiene #
- Treat keys like passwords: server-side only, never in browser code or public repos.
- Give each app, IDE, or agent its own key with its own budget and model allowlist — an agent gone wild can't drain your whole balance.
- If a key leaks, delete it in the dashboard. Revocation is immediate.
- Prefer environment variables (
ROUTERPLEX_API_KEY) over hardcoding.