Keys
A key is the unit of control here: the cap, the usage and the receipts all hang off it.
Minting
Keys are minted in API Keys. The plaintext appears once, at creation; the server keeps only a hash, so a leaked database does not leak anyone's key. Copy and store it right away.
sk-relay-... in the examples is a placeholder. Replace it with the full API key you created; never use the masked prefix, and never put keys in browser-side code or public repositories.
Sending it
| Format | Header |
|---|---|
| OpenAI | authorization: Bearer sk-relay-... |
| Anthropic | x-api-key: sk-relay-... (or the same bearer header, which Claude Code sends) |
Manage and cap
Create an independent key per project, and set each key's daily token quota (accumulated per UTC day; 0 means unlimited) and per-minute request cap. How quotas bound spend is covered in spend caps; a disabled key can no longer call the API.