Authentication & API keys
Use the right key for your application and your provider connections.
Two kinds of key
| Credential | Purpose | Where it belongs |
|---|---|---|
| CyberRouter API key | Authenticates your app to your CyberRouter account. | Your application’s server environment. |
| Provider API key | Connects your OpenAI, Anthropic, DeepSeek, or other provider account. | Your account’s connected providers in API Keys. |
Create and revoke application keys on API Keys. Revoking an application key blocks future use of that credential. A provider key is a separate connection and can be removed independently.
Authenticate API requests
curl http://localhost:3002/v1/key \
-H "Authorization: Bearer $CYBERROUTER_API_KEY"Use Authorization: Bearer … for chat and private account reads. Public model and provider discovery can be read without a key. Keep application keys on your server; do not embed them in public frontend bundles or URLs.
Browser sessions and password resets
When signed in, the website uses your browser session for the Playground, connections, usage, and credits. You do not need to paste an application key into Settings. Settings supports a separate manual API connection when needed.
Your profile holds your display name, password, and privacy preference. Password changes sign out other browser sessions. Forgot your password? Use Reset your password on the sign-in page. We email a single-use link from noreply@cyberrouter.ai that expires after 30 minutes. Choosing a new password signs you out everywhere.
Account changes require the browser’s same-origin session and CSRF protection. Inference API keys cannot grant data-sharing consent or purchase a subscription through the session-only checkout endpoint.