Authenticating requests to your endpoint
A private VM or Pod exposes an HTTPS endpoint. Authenticate to it with your OpenRelay API key sent as a Bearer token.
Every VM and Pod exposes an HTTPS endpoint. Whether a request needs authentication depends on how the endpoint is configured:
- Private endpoints require your OpenRelay API key. This is the default.
- Public endpoints need no auth: anyone with the URL can reach them.
Private is the default. Flip an endpoint to public (or back) with the
endpoint-visibility control on the VM page, with
POST /v1/vms/{id}/visibility, or by setting
public: true when you create the workload.
Private endpoints
Send your API key as a bearer token on every request. Set it once in your shell
as OPENRELAY_API_KEY, then pass it in the Authorization header:
export OPENRELAY_API_KEY="or_your_api_key"
curl -H "Authorization: Bearer $OPENRELAY_API_KEY" https://my-pod-a1b2c3.run.openrelay.inc/Use the endpoint URL shown in the dashboard for your VM or Pod, verbatim (it
already includes the https:// scheme). A Pod and a beta VM show a bare host
like https://my-pod-a1b2c3.run.openrelay.inc/; a production VM shows a per-port
form, https://<port>-<host>/. Requests without a valid key receive
401 Unauthorized.
x-api-key: $OPENRELAY_API_KEY is accepted as an equivalent to the
Authorization header, so the Anthropic SDKs reach a private endpoint unchanged.
The gateway consumes whichever header you send and strips it before proxying, so
a service that does its own Authorization-header auth never sees the platform
key.
Same key as the rest of the API
This is the same API key you use everywhere else. See Authentication for how to create, find, and rotate keys.
Public endpoints
A public endpoint accepts requests without any credentials. Anyone with the URL can reach it, so only make an endpoint public when the service behind it does its own authentication or is meant to be open.
curl https://my-pod-a1b2c3.run.openrelay.inc/