Getting started
Authentication & keys
Every API request is authenticated by your key. Keys are created in the dashboard and start with the prefix sk-ali-. Pass it in one of two equivalent ways — pick the one your client expects.
How to pass the key
Authorization: Bearer sk-ali-•••— for OpenAI-style clients (Cursor, Continue, OpenAI SDK);x-api-key: sk-ali-•••— for Anthropic-style clients (Claude Code, Cline, Anthropic SDK).
Both headers are equivalent: the service accepts either. If both are present, the first one found is used.
Key scoping
In the dashboard each key can be scoped to reduce risk if it leaks:
- an allow-list of IPs — requests from other addresses are rejected;
- a spend limit for the key;
- a model allow-list — the key may call only those models.
▲
Keys are stored hashed and can never be shown again. Save it at creation time. If lost — issue a new one and revoke the old key in the dashboard.