Authentication
AI Gateway keys, the headers that carry them, and the options a key can have.
Every request to https://ai.helipod.io except GET /health needs a Helipod AI key.
Key format
AI keys start with hel_ai_ followed by 40 URL-safe characters:
hel_ai_your_keyThe dashboard shows the first characters of each key (for example hel_ai_Xk3q) so you can tell keys apart. AI keys work only on the AI Gateway. Other Helipod keys (the Helipod API key, email API keys) are not accepted here, and an AI key is not accepted by the other Helipod APIs.
Sending the key
The gateway accepts the key in either header, on every route, so each SDK can use its native style:
| Header | Used by |
|---|---|
Authorization: Bearer hel_ai_your_key | OpenAI SDKs, curl, most OpenAI-compatible tools, Claude Code with ANTHROPIC_AUTH_TOKEN |
x-api-key: hel_ai_your_key | Anthropic SDKs, Claude Code with ANTHROPIC_API_KEY |
When both are present, Authorization wins. The header names are case-insensitive, and so is the word Bearer.
curl https://ai.helipod.io/v1/models \
-H "Authorization: Bearer hel_ai_your_key"curl https://ai.helipod.io/v1/models \
-H "x-api-key: hel_ai_your_key"A missing, unknown, revoked or expired key answers 401:
| Code | Meaning |
|---|---|
missing_api_key | No key in Authorization or x-api-key. |
invalid_api_key | The key does not exist, was revoked, or does not start with hel_ai_. |
expired_api_key | The key is past its expiry date. |
The error body follows the format of the route: OpenAI style on /v1/chat/completions and /v1/models, Anthropic style on /v1/messages. See Limits and errors.
Keys belong to a project, the balance to your account
- A key is created in one project. Open the project in the dashboard, go to AI Gateway, then API keys. Usage and charts can be filtered by project and by key.
- The AI balance is per account. All your projects spend from the same AI balance. A key always bills the AI balance of the person who created it, even on a project shared with a team.
- Up to 25 active keys per account. Revoke one to create another.
- Show it again. The full key is shown when you create it. Later, only you (the key's creator) can show it again from API keys. Each time a key is shown you get an in-app notification, so an unexpected one is easy to spot. Keys created before this feature existed cannot be shown again; create a new one instead.
- Revoke a key from API keys. It stops working within about 30 seconds. A new key works within a few seconds of being created.
Use a separate key for each app or environment, so you can limit, watch and revoke them one by one.
Key options
Set these when you create a key. They cannot be changed later; create a new key instead.
Prop
Type
A key can also carry its own requests-per-minute limit, on top of the account limit. When it is reached, requests answer 429 rate_limited and the message names the limit. See Limits and errors.
Keep keys secret
The gateway allows browser requests from any origin (CORS), like the OpenAI API, and never uses cookies. That makes it easy to try things from a browser, but a key in front-end code can be copied by anyone who opens the page and spent from your balance.
Call the gateway from your server, never ship a key in a web or mobile app, and read it from an environment variable or a secret manager. If a key leaks, revoke it in the dashboard and create a new one. A monthly spend limit and a model allowlist keep the damage of a leaked key small.