Create an API key in Token management. The full secret is shown only when it is created, so store it immediately in a password manager or secrets service.
OpenAI-compatible APIs
Most /v1/* endpoints use a bearer token:
Authorization: Bearer YOUR_API_KEY
curl https://api.nbility.ai/v1/models \
-H "Authorization: Bearer $NBILITY_API_KEY"
Native Claude API
Anthropic SDKs normally send x-api-key and require anthropic-version:
curl https://api.nbility.ai/v1/messages \
-H "x-api-key: $NBILITY_API_KEY" \
-H "anthropic-version: 2023-06-01" \
-H "content-type: application/json" \
-d '{"model":"claude-sonnet-4-6","max_tokens":256,"messages":[{"role":"user","content":"Hello"}]}'
Native Gemini API
Gemini SDKs use x-goog-api-key. The compatible API also accepts a ?key= query parameter, but the header is safer because it keeps the key out of URLs, proxy logs, and browser history.
x-goog-api-key: YOUR_API_KEY
Realtime WebSocket
The browser WebSocket API cannot set arbitrary request headers. The Realtime endpoint carries the key in the Sec-WebSocket-Protocol values; see Realtime API for the exact format. Do not put the key in an access_token query parameter.
Security practices
- Read the key from an environment variable such as
NBILITY_API_KEY; never commit it to Git. - Never embed a long-lived key in a browser, mobile app, or desktop installer. Send requests through your own backend.
- Create separate tokens for projects and environments, with appropriate quota and model restrictions, so each can be audited or revoked independently.
- For
401errors, verify that the key is complete and active and that the header matches the selected protocol.