API keys and authentication

Create an API key on the Keys page. Every request must include this key.

Request headers

Request format	Header
OpenAI	Authorization: Bearer $OMROUTER_API_KEY
Anthropic	x-api-key: $OMROUTER_API_KEY
Gemini	x-goog-api-key: $OMROUTER_API_KEY

Anthropic requests also require anthropic-version; see Anthropic SDK for a complete example.

Store the key in an environment variable

For local development:

export OMROUTER_API_KEY='your-api-key'

When deploying, enter the key in the hosting platform’s environment variable settings. Do not:

• Write the real key in code or commit it to Git.
• Put it in a webpage, browser extension, or mobile application.
• Send it in an issue, screenshot, log, or agent conversation.

If a webpage needs Omrouter, keep the key on your backend and send the Omrouter request from there.

Use separate keys for separate purposes

Use different keys for development, testing, and production. You can also create a separate key for each person or project and give each one its own quota and model restrictions.

After receiving a key, someone can check its balance and call history at key.omrouter.com without your Omrouter account password.

Replace an exposed key

1. Create a new key on the Keys page.
2. Update the application’s environment variable and test one request.
3. Delete the old key.

Replace a key immediately if it appears in Git history, logs, screenshots, or a public conversation.