Features

Authentication

Protect every request at the Router boundary

Octoryn API keys identify the customer or product environment making a request. Compatible clients send the key as a bearer token over TLS.

Bearer token

Send the API key in the Authorization header for every Router request.

Authorization: Bearer $OCTORYN_API_KEY

Scope keys by environment

Use a key issued for the correct workspace and environment. Product, Router and upstream provider credentials are separate security boundaries.

Keep development and production keys separate
Use the narrowest available workspace scope
Rotate exposed keys through the responsible operator
Do not pass upstream provider credentials to product clients

Keep credentials server-side

Load keys from a protected runtime environment or secret manager. A public web page may call your own backend, but it must not embed a Router key.

const client = new OpenAI({
  baseURL: "https://api.octoryn.dev/v1",
  apiKey: process.env.OCTORYN_API_KEY,
});

Handle authentication failures

Treat 401 as missing or invalid authentication and 403 as a policy or authorization decision. Surface a safe error to users and keep credential details out of logs.

NextChat completions →