Getting started
Authentication
One key authenticates every endpoint. The only thing that changes between protocols is which header carries it, and the gateway accepts either header on either surface.
Headers
OpenAI clients send a bearer token. Anthropic clients send x-api-key. Both are accepted everywhere, so if your client only knows how to set one of them, that is fine.
Authorization: Bearer sk-oa_...Scoping a key
A key can be restricted when you create it, and the restrictions are enforced at the gateway rather than in your client:
- Allowed models — requests for anything outside the list are refused with
403. Useful for keeping an experiment off the expensive models. - Monthly budget — once the key has spent its cap for the calendar month, further requests return
429. The wallet itself is untouched, so your other keys keep working.
Rotation and revocation
Revoking a key takes effect on the next request; there is no cache to wait out. Because we store only a hash, rotation is always issue-then-revoke rather than a reveal — create the replacement, deploy it, then revoke the old one.
Verifying a key works
The cheapest check is the model list, which is authenticated but free and calls no model:
curl https://api.overagent.cc/v1/models \
-H "Authorization: Bearer $OVERAGENT_API_KEY"A 401 means the key is wrong, revoked, or belongs to a disabled account. A 200 with a model list means you are ready to send real traffic.