Authentication
Every request needs a valid sk-... key. The same key works for both protocols, but the header format changes.
Creating a key
- Log in at codegate.dev.
- Open Console, API Keys.
- Click Add Token, give it a name, and save.
- Copy the
sk-...value. You cannot re-view it later; only reset or delete.
Treat the key like a password. Never commit it. Never paste it into a public issue or a screenshot.
Header formats
| Protocol | Endpoint | Auth header |
|---|---|---|
| OpenAI Chat Completions | /v1/chat/completions | Authorization: Bearer sk-... |
| OpenAI Responses | /v1/responses | Authorization: Bearer sk-... |
| Anthropic Messages | /v1/messages | x-api-key: sk-... + anthropic-version: 2023-06-01 |
OpenAI-shape example
curl https://codegate.dev/v1/chat/completions \
-H "Authorization: Bearer sk-..." \
-H "Content-Type: application/json" \
-d '{"model":"gpt-5.5","messages":[{"role":"user","content":"Hi"}]}'Anthropic-shape example
curl https://codegate.dev/v1/messages \
-H "x-api-key: sk-..." \
-H "anthropic-version: 2023-06-01" \
-H "content-type: application/json" \
-d '{"model":"claude-opus-4-8","max_tokens":256,"messages":[{"role":"user","content":"Hi"}]}'Environment variable conventions
Most tools read the key from an environment variable. Match the convention of whichever SDK is calling.
# For OpenAI SDKs, Codex, opencode
export OPENAI_API_KEY="sk-..."
export OPENAI_API_BASE="https://codegate.dev/v1"
# For the Anthropic SDK and Claude Code
export ANTHROPIC_API_KEY="sk-..."
export ANTHROPIC_BASE_URL="https://codegate.dev"The Anthropic base URL does not include the /v1 suffix. The Anthropic SDK appends /v1/messages on its own.
Rotating keys
If a key leaks or an employee leaves, rotate it. Open Console, API Keys, delete the old key, and create a new one. Old keys stop working immediately.
Multiple keys
You can create as many keys as you want. Common patterns:
- One key per environment:
local-dev,staging,production. - One key per teammate.
- One key per client tool (
claude-code,cursor,ci) so you can revoke a single tool without breaking the others.
Each key has its own usage log at Console, API Keys.
Server-side only
Never ship a key in a browser or mobile app binary. Call CodeGate from your own backend and forward what you need to the client. Anyone who has a key can spend the balance on it.