> ## Documentation Index
> Fetch the complete documentation index at: https://developers.meshapi.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Securely authenticate your requests to the Mesh API.

Mesh API uses standard HTTP `Authorization` headers with a **Router Service Key (RSK)**. All requests must be made over HTTPS.

## Key Types

### Router Service Keys (`rsk_...`)

Your primary method of interacting with the API. These are the keys you create in the dashboard.

```
Authorization: Bearer rsk_<RANDOM_CHARACTERS>
```

**What they control:**

* Access to all inference endpoints (`/v1/chat/completions`, `/v1/embeddings`, etc.)
* Per-key **spend caps** — set a maximum USD limit to prevent cost overruns
* Per-key **rate limits** — configurable Requests Per Minute (RPM), Requests Per Day (RPD), and Tokens Per Minute (TPM)
* Optional **default model** — a fallback model used when none is specified in the request

### Provider Keys (BYOK)

If you supply your own API keys for upstream providers (OpenAI, Anthropic, AWS Bedrock, Google Vertex AI), Mesh securely stores and uses them on your behalf. You never reference these directly in your API calls — Mesh handles routing transparently.

See [Bring Your Own Keys](/docs/capabilities/byok) for setup instructions.

***

## Security Best Practices

<Warning>
  Never expose `rsk_` keys in client-side code — browsers, mobile apps, or public repositories. Always proxy through your backend.
</Warning>

**1. Set spend caps** on every key. This limits your blast radius if a key is compromised — the attacker can only spend up to your cap.

**2. Use environment variables** — never hard-code keys in source files.

```bash theme={null}
# .env
MESH_API_KEY=rsk_...
```

**3. Rotate immediately** if you suspect a leak. Deactivate the compromised key in the dashboard and generate a new one. Old keys are invalidated instantly.

**4. Use separate keys per environment** — one for development, one for staging, one for production. This gives you clean audit trails and granular rate limiting.

**5. Monitor per-key usage** in the dashboard **Logs** section. Unexpected spikes often signal misuse before your spend cap triggers.

***

## Using the key

All examples in this documentation use `rsk_YOUR_KEY` as a placeholder. Replace it with your actual key:

<Tabs>
  <Tab title="curl">
    ```bash theme={null}
    curl https://api.meshapi.ai/v1/chat/completions \
      -H "Authorization: Bearer rsk_YOUR_KEY" \
      -H "Content-Type: application/json" \
      -d '{"model": "openai/gpt-4o-mini", "messages": [{"role": "user", "content": "Hi"}]}'
    ```
  </Tab>

  <Tab title="Python">
    ```python theme={null}
    import os
    from openai import OpenAI

    client = OpenAI(
        api_key=os.environ["MESH_API_KEY"],
        base_url="https://api.meshapi.ai/v1",
    )
    ```
  </Tab>

  <Tab title="Node.js">
    ```typescript theme={null}
    import OpenAI from "openai";

    const client = new OpenAI({
      apiKey: process.env.MESH_API_KEY,
      baseURL: "https://api.meshapi.ai/v1",
    });
    ```
  </Tab>
</Tabs>