Getting started

Authentication

How to authenticate requests to the TokenRouter gateway.

Every request to the gateway is authenticated with a TokenRouter API key. Keys are created in the console under API Keys and always start with tr_.

Bearer token

Send your key in the Authorization header on every request:

bash

curl https://api.tokenrouter.io/v1/models \
  -H "Authorization: Bearer tr_your_key_here"

The Anthropic-compatible /v1/messages endpoint additionally accepts the Anthropic-style x-api-key header — see Messages API.

Environment variables

Keep keys out of source code. The TokenRouter SDKs read TOKENROUTER_API_KEY automatically; stock OpenAI/Anthropic SDKs read their own variables:

bash

# TokenRouter SDKs
export TOKENROUTER_API_KEY=tr_your_key_here

# Stock OpenAI SDK (base URL swap)
export OPENAI_API_KEY=tr_your_key_here
export OPENAI_BASE_URL=https://api.tokenrouter.io/v1

# Stock Anthropic SDK / Claude Code (note: NO /v1 suffix)
export ANTHROPIC_AUTH_TOKEN=tr_your_key_here
export ANTHROPIC_BASE_URL=https://api.tokenrouter.io

Key hygiene

Create one key per app — budgets, rate limits, and analytics attribute per key.
Keys are shown once at creation and stored hashed; rotate from the console.
A revoked or deleted key fails immediately with 401 invalid_api_key — see Errors.