Every /v1 endpoint requires an API key. The health endpoints (/healthz, /readyz) do not.
Sending the key
Use either header. Both carry the same key, so use whichever your client library sends by default.
| Style | Header | Used by |
|---|---|---|
| OpenAI | Authorization: Bearer <key> | OpenAI SDKs, curl |
| Anthropic | x-api-key: <key> | Anthropic SDKs |
curl -sS https://api.ticonai.com/v1/models \
-H "Authorization: Bearer $AIP_API_KEY"curl -sS https://api.ticonai.com/v1/models \
-H "x-api-key: $AIP_API_KEY"If you send both headers they must contain the same key. If they differ, the request is refused with 401 invalid_api_key.
The key format is sk-aip-<prefix>-<secret>. See API keys.
The Anthropic version header
POST /v1/messages accepts an anthropic-version header. If you send it, it must be a date such as 2023-06-01, otherwise the request fails with 400 invalid_request. If you omit it, 2023-06-01 is assumed. Anthropic SDKs always send it.
When authentication fails
A missing, malformed, unknown, revoked or expired key all return the same answer, so the response never reveals whether a key exists:
curl -sS https://api.ticonai.com/v1/models \
-H "Authorization: Bearer sk-aip-00000000-00000000000000000000000000000000"curl -sS -o /dev/null -w "%{http_code}" https://api.ticonai.com/v1/models| HTTP | code | Meaning |
|---|---|---|
| 401 | invalid_api_key | Missing, malformed, unknown, revoked or expired key. |
| 403 | ip_not_allowed | The key has an IP allowlist and your address is not on it. |
| 403 | org_suspended | The organization that owns the key is suspended. |
| 403 | model_not_allowed | The key is limited to other models. |
| 429 | key_cap_exceeded | The key reached its monthly spending cap. |
| 429 | rate_limited | Too many requests, or too many failed authentication attempts from one IP address. |
The full list is on the Errors page.
Revocation and caching
The gateway caches validated keys for up to 10 seconds. A key you revoke in the app stops working within about 10 seconds.
Browsers
The API allows cross-origin requests from any origin and never reads cookies. That is convenient for tools, but a key placed in browser code is visible to every visitor. Call the API from a server, and keep keys in environment variables or a secret manager.