Authentication & virtual keys
Every Gateway request is authenticated with a virtual key — a scoped credential you create in the Portal, never your raw provider key.
Auth header
Send your virtual key as a standard bearer token:
Authorization: Bearer tvk_xxxxxxxxxxxxxxxxxxxxxxxxVirtual keys are always prefixed tvk_, stored hashed (never recoverable after creation), and shown to you exactly once at creation time in the Portal.
What a virtual key scopes
| Limit | What it controls |
|---|---|
| Model allowlist | Which provider/model values this key is allowed to call. A request naming a model outside the allowlist is rejected before it reaches a provider. |
| Budget | A maximum spend for the key, tracked against provider cost as computed from usage. |
| RPM / TPM | Requests-per-minute and tokens-per-minute ceilings, enforced independently of your plan's overall rate limit. |
| Fallback chains | An optional ordered list of provider/model candidates the key falls back to on error — see fallback chains. |
Personal vs. organization keys
A key belongs to either your personal account or, if you're part of a Teams organization, a shared org pool with per-member limits set by an admin. Both kinds work identically against the API — ownership only affects who can see and manage the key in the Portal.
Revoking a key
Revoke a key from the Portal at any time. Revocation is immediate — in-flight requests already accepted may complete, but no new request will authenticate with a revoked key.
Auth errors
An invalid, revoked, or disallowed-model request returns an OpenAI-shaped error object with an appropriate HTTP status — see the full error reference.
{
"error": {
"message": "Invalid API key provided.",
"type": "invalid_request_error",
"code": "invalid_api_key"
}
}