Authentication

API keys and security

Onysoft AI Gateway uses Bearer token authentication to verify API requests. On every API request, you must send your API key in the Authorization header. On the Anthropic Messages endpoints the key can also be sent in the x-api-key header (below).

API Key Format

Onysoft API keys start with the sk-ony- prefix and contain 48 hex characters:

sk-ony-ab824acfe047d4576799cc2d2a256e1aff4b0653306198bc

API Key Types

The system supports four different API key types. They all start in the same format (sk-ony-) but are issued from different sources:

Type	Intended For	Balance Currency	Pricing
User Key	End user creating it from the Dashboard (individual)	TL	List price
Project Key	Organization projects (assigned by admin)	TL	Customizable
Partner Project Key	A partner's own projects (from the partner portal)	USD	Set by the partner
Partner Customer Key	A partner's end customers (from the partner portal)	TL	Set by the partner

info

Important Note:

There is no difference for you, the API consumer — the same endpoints, the same parameters, the same response format. The key type is detected automatically on the backend, and balance deduction / logging / rate limiting are written to the correct table.

Using Your API Key

Send the Authorization header in the following format on every request:

                HTTP Header
            
Authorization: Bearer sk-ony-your-api-key

info

x-api-key (Anthropic endpoints only): on /v1/messages, /v1/messages/count_tokens and GET /v1/models with the anthropic-version header the key can also be sent in the x-api-key header (the Anthropic SDK and ANTHROPIC_API_KEY use it). If Authorization is present too, it is used. Other endpoints do not accept x-api-key and return 401.

                HTTP Header
            
x-api-key: sk-ony-your-api-key
anthropic-version: 2023-06-01

cURL Example

curl https://api.onysoft.com/v1/chat/completions \
  -H "Authorization: Bearer sk-ony-your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"model": "google/gemini-3.8-flash", "messages": [{"role": "user", "content": "Hi"}]}'
            

Security Recommendations

security

Protect Your API Key

Never use your API key in frontend code
Do not add your key to GitHub or other public repositories
Store it as an environment variable
Rotate your keys regularly

Using Environment Variables

                Bash
            
# .env file
ONYSOFT_API_KEY=sk-ony-your-api-key

                Python
            

import os
from openai import OpenAI

client = OpenAI(
    api_key=os.environ.get("ONYSOFT_API_KEY"),
    base_url="https://api.onysoft.com/v1"
)
            

Key Management

From the Dashboard:

Create new API keys
View and remove existing keys
See the last-used date for each key
Create multiple keys to use for different projects
By default you can have at most 5 active API keys per account; if the limit is reached, remove a key you no longer use
From each key's settings button you can set its API error language and its per-model limits (daily/monthly tokens, daily requests, blocking)
Per-minute and per-day request limits are counted per key and the balance per account: use a separate key for each tool and application