> ## Documentation Index
> Fetch the complete documentation index at: https://oma-codex-339-workspace-permissions.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Call OMA with a bearer token or X-Api-Key.

Public `/v1` resources accept workspace API keys. Each key belongs to an organization and workspace, and resource access is scoped to that tenant.

## Bearer authentication

```bash theme={null}
curl http://localhost:38080/v1/models \
  -H 'Authorization: Bearer sk-ant-local-default'
```

## X-Api-Key authentication

```bash theme={null}
curl http://localhost:38080/v1/models \
  -H 'X-Api-Key: sk-ant-local-default'
```

When both headers are present, OMA reads `X-Api-Key` first.

## SDK configuration

Point the compatible SDK base URL at OMA and supply the key through its standard API key option.

<CodeGroup>
  ```python Python theme={null}
  from anthropic import Anthropic

  client = Anthropic(
      api_key="sk-ant-local-default",
      base_url="http://localhost:38080",
  )
  ```

  ```typescript TypeScript theme={null}
  import Anthropic from "@anthropic-ai/sdk";

  const client = new Anthropic({
    apiKey: "sk-ant-local-default",
    baseURL: "http://localhost:38080",
  });
  ```
</CodeGroup>

## Security guidance

* The default development key is for local verification only.
* Never place keys in URLs, logs, screenshots, or frontend bundles.
* Use separate keys for different workspaces and purposes so you can revoke and audit them independently.
* Use TLS for remote OMA deployments.
* Console cookie sessions and `/v1` API keys are separate authentication boundaries.

<Warning>
  Filestore and the code-session runtime use protocol-specific credentials. Do not use those internal credentials as normal `/v1` API keys.
</Warning>