Getting started

Authentication

Every request to the gateway carries a bearer token. That token is an Openbase API key, never a provider key.

The header

Pass your key in the Authorization header. The OpenAI SDKs do this for you when you set api_key.

Authorization: Bearer sk-ob-xxxxxxxxxxxxxxxxxxxx

Key format

Keys begin with sk-ob-. Only a hash is stored, so a key cannot be recovered after creation. If it is lost, regenerate it, which issues a new secret and invalidates the old one immediately.

Keep keys server side

An Openbase key spends your balance. Never ship one in a browser bundle, a mobile app or a public repository. Proxy model calls through your own backend instead.

What a key controls

Property	Purpose
Name	Identifies the environment or service using the key in your logs.
Status	Disabling a key rejects its requests without deleting its usage history.
Monthly limit	An optional ceiling on spend, enforced per key rather than per account.
Last used	Shows whether a key is still in service before you revoke it.

Rotating a key

Create a second key and deploy it alongside the first.
Wait until the old key stops appearing in your request log.
Revoke the old key.

Regenerating in place is faster but causes a brief window where in-flight requests using the old secret are rejected, so prefer the sequence above for production traffic.

Errors

Status	Meaning
`401`	The key is missing, malformed, disabled or revoked.
`402`	The key is valid but the balance cannot cover the request.
`429`	The key exceeded its rate limit. Retry after a short backoff.