# Authentication

Authenticate every inference and account-usage request with a Zrelay API key. Paid keys start with zr_live_.

Source: https://zrelay.net/docs/api/authentication/

## OpenAI-compatible requests

```
Authorization: Bearer $ZRELAY_API_KEY
Content-Type: application/json
```

Use Bearer authentication for Chat Completions, Responses and supported image routes.

## Anthropic-compatible requests

```
x-api-key: $ZRELAY_API_KEY
anthropic-version: 2023-06-01
Content-Type: application/json
```

## Key scope

Flex and Prime keys serve one model family; each Xtra key serves models in its selected pool. A valid key can still be denied access to a different model, endpoint or unavailable route. Spending limits are separate from authentication.

## Protect and rotate keys

Send requests from your server. Keep keys out of URLs, frontend bundles, logs and repository files. If a key is exposed, revoke it in the portal and create a replacement. Never send a full key to support.