Authentication
Public keys use the gyw-sk-... format and are scoped to a model family and price group.
01
Headers
OpenAI
Bearer token
Authorization: Bearer gyw-sk-YOUR_KEYUse for Chat Completions, Responses, Images, and the Cursor bridge.
Anthropic
x-api-key
x-api-key: gyw-sk-YOUR_KEYFor the Messages API, also send anthropic-version: 2023-06-01.
02
Key scope
A single key does not automatically grant access to every family.
| Check | Result |
|---|---|
| Key family matches the model | Request can continue |
| Model is outside the scope | 403 key_scope_not_supported |
| Endpoint is unsupported by the model | 403 endpoint_not_supported |
| Private group is unavailable to the account | 403 trusted_access_required |
03
401 vs 403
401 means the key is missing, revoked, or unrecognized. 403 means the key is valid but does not allow the selected model, endpoint, or private group.
04
Secret handling
- Store the key in an environment variable or secret manager.
- Do not put the key in git, browser JavaScript, or screenshots.
- Revoke a compromised key in the cabinet and create a new one.
- The setup assistant in these docs processes an entered key only in the browser and does not save it.