Platform API Authentication

Platform API requests authenticate with a Management Key sent as a Bearer token:

Authorization: Bearer rat_your_management_key

For example:

curl https://www.routeapi.ai/api/open/v1/balance \
  -H "Authorization: Bearer $ROUTEAPI_MANAGEMENT_KEY"

Management Key

A Management Key is the credential for the Platform API (/api/open/v1) and starts with rat_. It is a different credential from the sk- API Key used to call models:

Credential	Prefix	Purpose
Management Key	rat_	Call /api/open/v1 to manage your account and API Keys
API Key	sk-	Call model endpoints (such as /v1/chat/completions), see Chat Completions

A Management Key can only operate on resources owned by its user. It does not inherit admin permissions and cannot manage Management Keys through the Platform API.

Keep it secret

A Management Key can manage the API Keys in your account, and can read their full plaintext values through Reveal an API Key. Do not commit it to repositories, embed it in frontend code, or share it with others. The plaintext is shown only once at creation; if you lose it, create a new one.

Create a Management Key

1. Log in to the RouteAPI console.
2. Open Management Keys in the sidebar (between Billing and Playground), or go directly to console/management-keys.
3. Enter a name, choose an expiration time, then create the Key.
4. Copy and store the plaintext Key starting with rat_ right away.

Each user can keep up to 10 Management Keys. Expired Keys stay in the list and still count toward the limit; delete a Key to free a slot. If a Key leaks, delete it on the same page; deletion takes effect immediately.

New Management Keys can only be deleted, not revoked or re-enabled. Deleting a Key is the only way to disable it, and requests using a deleted Key fail with 401 invalid_token.

Security recommendations

• Store Management Keys in a secret manager or CI secret, never in source code or configuration files that are committed.
• Create a separate Management Key for each script or service, so you can delete one without affecting the others.
• Set an expiration time. A Key you no longer need should be deleted rather than left to expire.
• Grant the key only to the systems that actually manage your account. Applications that call models need an sk- API Key, not this one.
• Review the Management Keys list regularly and delete any Key you no longer recognize.

Credential mix-ups

The two credentials are not interchangeable, and each API rejects the other’s Key with 401:

Request	Result
sk- API Key sent to /api/open/v1	401 invalid_token — the path expects a Management Key
rat_ Management Key sent to model endpoints such as /v1/chat/completions	401 authentication error — the path expects an API Key

If a request to either API returns 401 even though the Key looks valid, check which page you created it on and which prefix it has.

For error codes and rate limits, see Errors and limits.