API keys

FUNCD API keys control authentication, model access, spending limits, and expiration.

Authentication

OpenAI-compatible endpoints use a Bearer token:

Authorization: Bearer YOUR_API_KEY

Anthropic Messages uses x-api-key:

x-api-key: YOUR_API_KEY

Model access

Choose one scope when creating or editing a key:

• All models includes current and future published models.
• Selected models allows only the models you choose.

Calls outside the key's scope return 403 model_not_allowed.

Spending limit and expiration

The lifetime spending limit includes completed usage and reservations held by in-flight requests. The account balance always applies.

An expired key cannot start new requests. Editing a key does not reset its accumulated spend.

Security guidance

• Use a separate key for each application and environment.
• Never embed a key in browser code, mobile packages, or public repositories.
• Inject credentials through environment variables or a secret manager.
• Revoke a key immediately if it may have leaked.
• Add a reasonable limit and expiration to automation and test keys.