Endpoint authentication
A private VM or Pod exposes an HTTPS endpoint. Authenticate to it with your OpenRelay API key sent as a Bearer token.
Every VM and Pod exposes an HTTPS endpoint. Whether a request needs authentication depends on how the endpoint is configured:
- Private endpoints require your OpenRelay API key. This is the default.
- Public endpoints need no auth: anyone with the URL can reach them.
Private is the default. Flip an endpoint to public (or back) with the
endpoint-visibility control on the VM page, with
POST /v1/vms/{id}/visibility, or by setting
public: true when you create the workload.
Private endpoints
Send your API key as a bearer token on every request. Set it once in your shell
as OPENRELAY_API_KEY, then pass it in the Authorization header:
export OPENRELAY_API_KEY="or_your_api_key"
curl -H "Authorization: Bearer $OPENRELAY_API_KEY" https://my-pod-a1b2c3.run.openrelay.inc/Use the endpoint URL shown in the dashboard for your VM or Pod, verbatim (it
already includes the https:// scheme). A Pod and a beta VM show a bare host
like https://my-pod-a1b2c3.run.openrelay.inc/; a production VM shows a per-port
form, https://<port>-<host>/. Requests without a valid key receive
401 Unauthorized.
x-api-key: $OPENRELAY_API_KEY is accepted as an equivalent to the
Authorization header, so the Anthropic SDKs reach a private endpoint unchanged.
The gateway consumes whichever header you send and strips it before proxying, so
a service that does its own Authorization-header auth never sees the platform
key.
Same key as the rest of the API
This is the same API key you use everywhere else. See Authentication for how to create, find, and rotate keys.
Public endpoints
A public endpoint accepts requests without any credentials. Anyone with the URL can reach it, so only make an endpoint public when the service behind it does its own authentication or is meant to be open.
curl https://my-pod-a1b2c3.run.openrelay.inc/SSH troubleshooting
Fix Permission denied (publickey), "No running VM found" and other SSH errors on an OpenRelay GPU VM, verify its host key, and connect from Windows.
Pods and persistent storage
Bring-your-own-container GPU pods, what survives a stop, restart, crash or node loss, and how the /workspace volume is billed and retained.