Authentication

Public /v1 resources accept workspace API keys. Each key belongs to an organization and workspace, and resource access is scoped to that tenant.

Bearer authentication

curl http://localhost:38080/v1/models \
  -H 'Authorization: Bearer sk-ant-local-default'

curl http://localhost:38080/v1/models \
  -H 'X-Api-Key: sk-ant-local-default'

When both headers are present, OMA reads X-Api-Key first.

Point the compatible SDK base URL at OMA and supply the key through its standard API key option.

from anthropic import Anthropic

client = Anthropic(
    api_key="sk-ant-local-default",
    base_url="http://localhost:38080",
)

import Anthropic from "@anthropic-ai/sdk";

const client = new Anthropic({
  apiKey: "sk-ant-local-default",
  baseURL: "http://localhost:38080",
});

The default development key is for local verification only.
Never place keys in URLs, logs, screenshots, or frontend bundles.
Use separate keys for different workspaces and purposes so you can revoke and audit them independently.
Use TLS for remote OMA deployments.
Console cookie sessions and /v1 API keys are separate authentication boundaries.

Filestore and the code-session runtime use protocol-specific credentials. Do not use those internal credentials as normal /v1 API keys.