Authentication

OneProvider accepts both OpenAI-style Bearer and Anthropic-style x-api-key. Pass either, never both.

Header forms

The API accepts either header. Use whichever your SDK already emits.

Authorization: Bearer sk-... # OpenAI-style
x-api-key: sk-... # Anthropic-style

Environment variables

Our examples keep the key in ONEPROVIDER_KEY. SDK clients, though, auto-read their own native names by default — either export the key under that name, or pass ONEPROVIDER_KEY explicitly to the constructor. The matrix below shows what each tool reads:

Verifying authentication

Hit /v1/models for a cheap, side-effect-free check:

curl -s https://api.oneprovider.dev/v1/models \
-H "x-api-key: $ONEPROVIDER_KEY" | jq '.data[].id'

A successful response lists the current models. A 401 here means the key is malformed, revoked or not yet active.

Where to keep the key

• Environment variables — the default for most use cases.
• ~/.zshrc / ~/.bashrc with HISTCONTROL=ignorespace set, so leading-space commands don’t hit shell history.
• Secret managers: 1Password CLI, AWS Secrets Manager, Doppler, GCP Secret Manager.
• Per-project .env files — always .gitignored.

Common pitfalls

• Trailing slash. https://api.oneprovider.dev/v1/ vs https://api.oneprovider.dev/v1 — some SDKs concatenate the path naively. Use the no-trailing-slash form above.
• Double Bearer. Authorization: Bearer Bearer sk-... happens when a tool already prepends Bearer and you re-add it. Strip the prefix in your config.
• Anthropic version header. Always include anthropic-version: 2023-06-01 on raw HTTP calls. SDKs add it for you.

Rotating keys

Issue a new key in the cabinet (“Keys” → “Issue a key”), update it in your clients, then delete the old one. It is instant and free, and the balance is shared by all keys of the cabinet. More: Cabinet & keys .

Quick answers

Which base URL do I use?

Claude Code and Anthropic SDKs use https://api.oneprovider.dev. OpenAI SDKs and OpenAI-compatible clients use https://api.oneprovider.dev/v1. One key works behind both; the model list is on the models page ; rates are on the pricing page .

How do I authenticate?

Send the raw sk-… key in x-api-key or Authorization: Bearer: one of them, never both. Keep the key in an environment variable, not in a file that gets committed. More on authentication .

Where do I get a key?

Open your cabinet in the Telegram bot @oneprovider_robot or at app.oneprovider.dev, top up the balance and press “Issue a key”. Each key can carry its own spend limit. Cabinet & API keys .

What do 401, 404 and 429 mean?

401: the key is missing, mistyped or sent in the wrong header; paste the whole key without quotes or spaces. 404: usually a wrong base URL, for example a missing or doubled /v1. 429 with “Insufficient balance”: the cabinet balance or the key’s spend limit is used up, so top up instead of retrying; any other 429 is a rate limit, so wait for Retry-After. Details: error codes and troubleshooting .

Why do streams cut off or reset?

VPN and VLESS proxies often buffer SSE or break HTTP/2 negotiation. OneProvider has no regional restrictions and does not buffer streams, so turn the proxy off and retry.

Where do I ask if this is not enough?

Message @Oneproviderhelpbot on Telegram or open “Support” in the web cabinet, with the HTTP status code and the exact error message. How support works .