Authentication

How Triw authenticates requests, and which header format to use per protocol.

Every request needs an API key created in the console. One key works across all compatible protocols — OpenAI, Anthropic and Gemini — because Triw reads the key from whichever header that protocol uses.

Accepted headers

Protocol	Header	Notes
OpenAI-style	Authorization: Bearer sk-...	Preferred for everything
Anthropic-style	x-api-key: sk-...	Accepted on /v1/messages
Gemini-style	x-goog-api-key: sk-...	Accepted on /v1beta/...

If you send more than one, Authorization wins.

curl https://router.triw.io/v1/chat/completions \
  -H "Authorization: Bearer sk-..." \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-4o-mini","messages":[{"role":"user","content":"ping"}]}'

Key format and scope

• Keys are prefixed sk- and are created per account, not per model.
• A key inherits the group and quota you set when creating it, plus optional expiry and model allow-list.
• Keys are shown in the console; treat them like passwords. Rotate immediately if one leaks — see API keys.

What is not an API key

• Your console session cookie (browser login) is not valid on /v1/*.
• A provider key (OpenAI, Anthropic, Google) cannot be used against Triw. Only Triw keys are accepted.

Failure behavior

A missing, malformed, expired, disabled or over-quota key returns HTTP 401 or 403 with code set to invalid_api_key or insufficient_user_quota. Full table: Errors. Route list per protocol: Endpoints.