# Authentication

Authenticate safely with Bearer or x-api-key headers.

Use a Bearer token for normal OpenAI-compatible clients:

```http
Authorization: Bearer $KOSCOMPUTE_API_KEY
```

The `x-api-key` header is also supported, primarily for Anthropic-compatible clients:

```http
x-api-key: $KOSCOMPUTE_API_KEY
```

If both headers are present, they must contain the same credential. Conflicting credentials return `401`.

## Public endpoints

`GET /v1/models`, `GET /health`, and `HEAD /` do not require authentication. Supplying an authentication header to `/v1/models` is allowed and can restrict results to models accessible by that key.

## Rejected patterns

Query-string credentials such as `?api_key=...` are rejected. URLs are commonly logged by proxies, browsers, and monitoring systems, so keys must remain in headers.

Do not expose a key in browser JavaScript, mobile application bundles, screenshots, shell history, or public repositories. Use a server-side secret store and rotate any credential that may have been disclosed.

## Authentication errors

- `401` — missing, invalid, expired, inactive, or conflicting credentials.
- `403` — the key is valid but lacks access to the requested model or operation.

Authentication success does not guarantee model access, remaining account balance, or available capacity.