Authentication

The ways to send your key in request headers.

Every model endpoint needs your key in a request header. Create keys on API Keys.

Bearer token (recommended)

Works on every endpoint:

Authorization: Bearer sk-xxxxxxxxxxxxxxxx

The sk- prefix is optional.

Other forms

For compatibility with vendor SDKs, some endpoints also accept:

Header / parameter	Endpoints	Notes
`x-api-key: sk-xxxxxxxxxxxxxxxx`	`/v1/messages`, `/v1/models`	The Anthropic SDK form, usually with `anthropic-version: 2023-06-01`
`x-goog-api-key: sk-xxxxxxxxxxxxxxxx`	Gemini native `/v1beta/models/...`, `/v1/models`	The Google SDK form
`?key=sk-xxxxxxxxxxxxxxxx`	Gemini native `/v1beta/models/...`, `/v1/models`	In the URL, where logs can capture it; not recommended

# Anthropic format
curl https://tokenfunc.com/v1/messages \
  -H "x-api-key: sk-xxxxxxxxxxxxxxxx" \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{"model": "claude-sonnet-4-5", "max_tokens": 256, "messages": [{"role": "user", "content": "Hello"}]}'

Key limits

When you create or edit a key you can set these limits; requests beyond them are rejected:

Limit	When exceeded
Quota cap	`401` once the key's quota is used up
Allowed models	`403` for models the key may not use
IP allowlist	`403` for requests from other IPs
Expiry	`401` after expiry
Group	Only the group's models are available; `403` if the group is not available to your account or has been retired

Security advice

A key is a payment credential: whoever holds it can spend your balance.
Use one key per tool or project and give it a quota cap when it makes sense.
Never put keys in frontend code, commit them, or paste them in chats. Call the API from the browser only through your own backend.
If a key may have leaked, delete or disable it on API Keys right away.