Authentication
How to send your ORYNX key and what each key is allowed to do.
Every request needs your ORYNX key. A key is sk-orynx- followed by 49 letters and digits. The last 6 characters
are a checksum, so ORYNX rejects a mistyped key before it looks the key up.
Sending the key
ORYNX accepts the key in whichever header your client already uses:
| Header | Used by |
|---|---|
Authorization: Bearer sk-orynx-... | OpenAI SDKs, most tools, Claude Code with ANTHROPIC_AUTH_TOKEN |
x-api-key: sk-orynx-... | Anthropic SDKs, Claude Code with ANTHROPIC_API_KEY |
x-goog-api-key: sk-orynx-... | Google GenAI SDK |
?key=sk-orynx-... | Gemini REST clients that only support a query parameter |
If a request carries more than one, the Authorization header is used.
Prefer a header to the ?key= query parameter. URLs end up in browser history and proxy logs.
What a key controls
- Models. A key works only for the model families it was issued for, and can be limited to specific models.
Any other model returns
403in your client's error format. - Credit. Each request is charged at the model's published price. When the credit is used up, requests are refused until the key is topped up.
- Expiry. A key works for a set number of days from the day it was issued.
- Limits. Each key has a concurrency limit (5 parallel requests by default) and may have a requests-per-minute limit. See Rate limits.
- IP allowlist (optional). A key can be locked to your server addresses. Don't use an allowlist with tools that send requests from their own cloud, such as Cursor.
Keeping your key safe
- Keep keys in environment variables or a secret manager, never in client-side code or public repositories.
- ORYNX stores only a keyed hash of your key, so it can't show the key again. If you lose a key or think it has leaked, ask the person or team who issued it to rotate it. You get a new key with the same credit and history, and the old one stops working at once.