Authentication

All API requests require authentication using an API key passed via the x-api-key header.

API Key Header

Pass your API key in every request using the x-api-key header:

Bash
curl https://api.mr-coder.io/v1/messages \
  -H "x-api-key: sk-mr-auth-xxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -H "anthropic-version: 2023-06-01" \
  -d '{"model": "claude-sonnet-4-6", "max_tokens": 100, "messages": [{"role": "user", "content": "Hello"}]}'

Alternatively, use the Authorization header with a Bearer token:

Bash
Authorization: Bearer sk-mr-auth-xxxxxxxxxxxxxxxxxxxxxxxxxxxx

Key Types

MR Coder supports two types of API keys, distinguished by their prefix:

sk-mr-auth-Auth Key (OAuth)

Used for web chat users authenticated via OAuth. Auth keys are tied to a user's Claude.ai OAuth account and have specific rate limits and token budgets assigned by the admin. These keys are created automatically when a user connects their Claude.ai account through the web interface.

Key Management

API keys are managed through the MR Coder dashboard. Keys can be created, rotated, and revoked at any time without affecting other keys.

1

Create — Go to Dashboard → API Keys to create a new key. Assign rate limits, token windows, and allowed models.

2

Rotate — Generate a new key while keeping the old one active for a grace period. Update applications to use the new key, then revoke the old one.

3

Revoke — Immediately invalidate a key. All requests using the revoked key will return 401 authentication_error.

Key Security Best Practices

  • •Never expose keys — Do not commit API keys to version control. Use environment variables or a secrets manager (e.g., GitHub Secrets, AWS Secrets Manager, HashiCorp Vault).
  • •Rotate regularly — Rotate keys every 90 days or immediately if a key is suspected to be compromised.
  • •Use least privilege — Create separate keys for different environments (dev, staging, production) and use model restrictions to limit what each key can access.
  • •Monitor usage — Use the Key Status endpoint to track usage and set up alerts for unusual activity.

Authentication Strategies

For web chat users

Users authenticate through the MR Coder web interface using Claude.ai OAuth. The system automatically resolves the user's OAuth session to their auth key. No manual key handling is required — just ensure the user has an active session.

For external developers

Create a manual API key from the dashboard. Provide the key securely (e.g., via a password manager). The developer passes the key in the x-api-key header.

For internal services

Use environment variables or a secrets manager to store keys. Configure your CI/CD pipeline to inject keys at deploy time. Rotate keys regularly and use model restrictions for additional security.

← API OverviewBase URL, errors, and rate limitsMessages Endpoint →Send messages with streaming support