THE INTEGRATION GUIDE
Authentication
Every endpoint — inference, model catalog, usage, and billing — authenticates with a key created on the API Keys page (it starts with sk-hb-). The protocol style is determined by the request path, so one key works across all of them.
OpenAI style (default)
Used for /v1/chat/completions, /v1/responses, /v1/embeddings, /v1/images/generations, /v1/videos, /v1/models, /v1/usage/*, and /v1/billing/*. The inference and generation endpoints read the Authorization header only; /v1/models, /v1/usage/*, and /v1/billing/* also accept x-api-key.
Authorization: Bearer <YOUR_API_KEY>Anthropic / Claude style
Used for /v1/messages, /v1/models, /v1/usage/*, and /v1/billing/*. Besides Authorization: Bearer, Anthropic's x-api-key header is accepted, so the official SDKs and ANTHROPIC_API_KEY work unchanged (this is also what makes client.models.list() work out of the box); when both are sent, Authorization wins. The anthropic-version header is optional.
x-api-key: <YOUR_API_KEY>Security best practices
- Never commit API keys to version control or expose them in client-side code.
- Use different keys for development and production environments.
- Rotate keys periodically and revoke compromised keys immediately from the API Keys page.
- Set an expiry date on keys, and revoke short-lived keys as soon as you are done with them.