API keys and authentication
Create and manage AGTCloud API keys and configure authentication headers.
API keys authenticate requests to AGTCloud. Most endpoints use a Bearer API key. Compatible protocols such as Anthropic Messages use protocol-specific authentication headers; see the corresponding endpoint page for the exact requirements.
| Setting | Value |
|---|---|
| Base URL | https://api.agtcloud.cn/v1 |
| Most endpoints | Authorization: Bearer your-api-key |
| Anthropic Messages | x-api-key: your-api-key and anthropic-version: 2023-06-01 |
Create an API key
- Open API Keys.
- Select Create API Key.
- Copy the API key and store it securely.
Store API keys securely
Do not expose complete keys in screenshots, support tickets, chats, or public code. Disable or delete a key immediately if it may have been exposed.
Use an API key
Bearer authentication
Use https://api.agtcloud.cn/v1 as the Base URL and add this header:
Authorization: Bearer your-api-keyThe recommended Base URL already includes /v1. Do not append another /v1 when building a request URL.
Verify a key
Request the models visible to the current API key to verify the Base URL and authentication settings:
curl 'https://api.agtcloud.cn/v1/models' \
-H 'Authorization: Bearer your-api-key'Anthropic Messages
For Anthropic Messages-compatible requests, send the key in x-api-key and include anthropic-version:
x-api-key: your-api-key
anthropic-version: 2023-06-01See Anthropic Messages for complete request requirements.
Manage API keys
In API Keys, you can:
- Add tokens for separate applications or environments.
- Disable tokens that are no longer used or may have been exposed.
- Delete obsolete tokens.
Third-party tool configuration
Tools that use an OpenAI-compatible API usually require these settings:
| Setting | Value |
|---|---|
| API host / Base URL | https://api.agtcloud.cn/v1 |
| API key | An API key created for the current account |
| Model | A model ID available to the current site and account |
Find model IDs in the Model marketplace. See Third-party integrations for configuration instructions.
Security management
Production services should read API keys from server-side environment variables or a secret manager:
export AGTCLOUD_API_KEY='your-api-key'- Never commit an API key to source control.
- Never send a secret key to a browser or untrusted client.
- Use separate keys for development, testing, and production.
- Replace a key immediately if it may have been exposed.