> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corvex.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate inference requests with your Corvex virtual key.

Corvex uses a single customer key type: a **virtual key** with the
`sk-corvex-` prefix. Send it as an HTTP Bearer token on the OpenAI-compatible
endpoints, or as an `x-api-key` header on the Anthropic-compatible
`/v1/messages` surface.

## Virtual keys (`sk-corvex-*`)

Use your virtual key on every inference endpoint: `/v1/chat/completions`,
`/v1/completions`, `/v1/responses`, `/v1/messages`,
`/v1/messages/count_tokens`, and `/v1/models`, plus the usage endpoint
`/api/v1/usage`. (A `/v1/embeddings` endpoint also exists, but no embedding
model is currently deployed.)

<CodeGroup>
  ```
  Authorization: Bearer sk-corvex-...
  ```

  ```
  x-api-key: sk-corvex-...
  ```
</CodeGroup>

Use the `Authorization: Bearer` header on the OpenAI-compatible endpoints. On
the Anthropic-compatible `/v1/messages` and `/v1/messages/count_tokens`
endpoints, send your key as an `x-api-key` header (as the Anthropic SDK and
Claude Code expect).

The current prefix is `sk-corvex-`. Legacy `sk-bf-*` keys minted before the
cutover are still accepted, so existing integrations keep working — but new
keys are issued with the `sk-corvex-` prefix.

Your key is scoped to your account, and the models it can reach and any usage
limits are managed for you from the dashboard.

<Warning>
  Treat your virtual key like a password. Keep it server-side, never commit it
  to source control, and don't ship it to client devices or browsers. If a key
  is exposed, revoke it from the dashboard and mint a new one.
</Warning>

## Where to mint keys

Mint virtual keys from the **Corvex dashboard** — sign in at
[tokenfactory.corvex.cloud](https://tokenfactory.corvex.cloud/app) and create a
key from your API-keys section. The key value (`sk-corvex-...`) is shown
**once** — copy it immediately and store it somewhere safe.

<Note>
  Keys are created and revoked from the dashboard. There is no API to create or
  manage keys programmatically.
</Note>

## Rate limits

If you exceed your rate limit you'll receive an `HTTP 429 Too Many Requests`
response with a `Retry-After` header indicating how long to wait before
retrying. Back off for the indicated interval, then retry your request.

You can review your current usage from the
[dashboard](https://tokenfactory.corvex.cloud/app), or fetch it
programmatically from `/api/v1/usage` using the same virtual key.

## Going further

<CardGroup cols={2}>
  <Card title="API Reference" icon="code" href="/api-reference/openapi">
    Full endpoint list and request/response schemas.
  </Card>

  <Card title="Errors" icon="triangle-exclamation" href="/reference/errors">
    Full HTTP status code list.
  </Card>
</CardGroup>