Authentication

Each request to an endpoint that costs money carries your API key in one of two headers:

Authorization: Bearer sk-kont-...
x-api-key: sk-kont-...

The two headers have the same effect. The OpenAI SDKs, Codex and OpenCode send the first header. The Anthropic SDKs send the second header. Claude Code sends the header that agrees with its variable: ANTHROPIC_AUTH_TOKEN sends the first header, and ANTHROPIC_API_KEY sends the second header.

A key starts with sk-kont-, and 48 hex characters follow. The sk- prefix tells the API that the value is a key. The kont- part lets a secret scanner find a key that you put in a public place by accident.

Create a key

Create a key on the API keys page of the dashboard. We show the key one time only. We keep only a hash of the key, so we cannot show it to you again. If you lose a key, revoke it and create a new key.

A key cannot manage keys

Only a signed-in dashboard session can create, list or revoke keys. A key can spend your balance, but it cannot make a new key. Thus, if a key leaks, revoke it. The person who has the key cannot make a replacement.

Revoke a key

Revoke a key on the API keys page. The key stops on the next request. We remove the key from our cache at the same time.

What each endpoint needs

Endpoint	Key	Notes
POST /v1/chat/completions	Yes	The dashboard playground uses a session cookie instead, with a lower limit
POST /v1/messages	Yes
POST /v1/messages/count_tokens	Yes	No charge
POST /v1/responses	Yes
GET /v1/models, GET /v1/models/{id}	No	The price list is public
/api/v1/*	Session cookie	The dashboard uses these routes. Do not use them in your code

Errors

A request with no key, a key in the wrong format or a revoked key gets a 401 error with the type authentication_error. On /v1/messages, the error has the Anthropic format. See Errors.

A correct key on an account with too little balance gets a 402 error, not a 401 error. A 401 means that you must correct the key. A 402 means that you must add balance.