Authentication

WRouter uses Bearer-token authentication.

Obtaining a token

See API Token Management.

Tokens look like:

sk-vN8x9...HJ3kQpZ

Sending a token

HTTP header

Every endpoint accepts the Authorization header:

Authorization: Bearer sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Protocol-native headers

Some protocol endpoints also accept their native auth headers. For /v1/messages:

x-api-key: sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
anthropic-version: 2023-06-01

For /v1beta/models/{model}:generateContent:

x-goog-api-key: sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

or via query string ?key=sk-....

Error responses

HTTP	Meaning
401	Missing / invalid / disabled / expired token
403	Token cannot use this model, or IP not allowed
429	Rate-limited

See Errors.

Security best practices

• Never commit tokens — use env vars like WROUTER_API_KEY, add to .gitignore
• Don't ship tokens in browser or mobile bundles — proxy via your backend
• One token per app with the smallest possible model allowlist and quota
• Pin IPs for production
• Rotate every 90 days
• On leak: delete the token immediately and audit Call logs