Authentication
Authenticate safely with Bearer or x-api-key headers.
Use a Bearer token for normal OpenAI-compatible clients:
Authorization: Bearer $KOSCOMPUTE_API_KEY
The x-api-key header is also supported, primarily for Anthropic-compatible clients:
x-api-key: $KOSCOMPUTE_API_KEY
If both headers are present, they must contain the same credential. Conflicting credentials return 401.
Public endpoints¶
GET /v1/models, GET /health, and HEAD / do not require authentication. Supplying an authentication header to /v1/models is allowed and can restrict results to models accessible by that key.
Rejected patterns¶
Query-string credentials such as ?api_key=... are rejected. URLs are commonly logged by proxies, browsers, and monitoring systems, so keys must remain in headers.
Do not expose a key in browser JavaScript, mobile application bundles, screenshots, shell history, or public repositories. Use a server-side secret store and rotate any credential that may have been disclosed.
Authentication errors¶
401— missing, invalid, expired, inactive, or conflicting credentials.403— the key is valid but lacks access to the requested model or operation.
Authentication success does not guarantee model access, remaining account balance, or available capacity.