Authentication & keys
Choose the correct key, authenticate requests, and manage access.
Hosts & key types
| Service | Base URL | Credential |
|---|---|---|
| Website and console | https://17.wtf | Account sign-in |
| Model API | https://api.17.wtf/v1 | Model API key |
| Tools API | https://tapi.17.wtf/v1 | Tool API key |
Model keys work for text and image endpoints. Tool keys work on the tools service. Using a key on the wrong service returns 403. Dashboard sign-in credentials are separate from API keys.
Request headers
Send one authentication header: Authorization: Bearer YOUR_KEY or x-api-key: YOUR_KEY. Send Content-Type: application/json for JSON requests. Anthropic clients also send anthropic-version; use 2023-06-01 in HTTP examples.
Authorization: Bearer YOUR_MODEL_API_KEY
Content-Type: application/jsonCreate, rotate & revoke
Create model keys in API Keys. Create tool keys inside a tool in Tools Studio. Name keys by application or environment so usage is easy to identify. To rotate, create a new key, update your application, verify a request, then revoke the old key. Revoking a key prevents future authentication.
Keep secrets on your server
Load keys from environment variables or a secret manager. Do not embed them in browser bundles, mobile apps, public repositories, screenshots, or shared logs. If a secret is exposed, revoke it and replace it. Account restrictions, verification, beta access, balances, and rate limits can still restrict an authenticated request.