API keys
An API key lets your code call hxa.net. You can create several keys, for example one per application or environment, each with its own limits.
Create a key
- In the console, open API Keys and click Create API Key.
- Fill in the fields below and save.
- Copy the key with the copy button next to it. The list shows keys partly hidden; the copy button copies the full key.
| Field | What it does |
|---|---|
| Name | A label for you, such as prod-backend. |
| Group | Required. Decides which models and rates the key uses. Pick the group for the provider you call (Anthropic or OpenAI). |
| Custom Key | Optional. Set your own key value (at least 16 characters: letters, digits, _ or -). Leave empty to generate one. |
| IP Restriction | Optional. An IP whitelist or blacklist, one IP or CIDR range per line. With a whitelist, requests from other addresses are rejected. |
| Quota Amount | Optional. The most this key can spend, in USD. 0 means no limit. Use Reset to start counting again. |
| Rate Limit | Optional. Spending caps in USD per 5 hours, per day and per 7 days. |
| Expiration | A preset number of days, a custom date, or Never. |
Use the key
Send the key in the Authorization: Bearer header (OpenAI format) or the x-api-key header (Anthropic format). Keys in the URL query string are rejected. See API reference.
Click Use Key on a key to get ready-made setup for coding tools, including Claude Code, Codex CLI, Gemini CLI and OpenCode, for macOS/Linux and Windows. For example, for Claude Code:
export ANTHROPIC_BASE_URL="https://hxa.net"
export ANTHROPIC_AUTH_TOKEN="YOUR_HXA_API_KEY"For Codex CLI, set base_url = "https://hxa.net/v1" in ~/.codex/config.toml; the Use Key dialog shows the complete file.
Manage keys
- Edit changes the name, group, limits and expiration. The key value stays the same.
- Disable stops the key from working until you enable it again. A key also stops working when it expires or its quota is used up.
- Delete removes the key permanently. Requests with it fail immediately.
- The list shows each key's usage today and over the last 30 days, its quota, when it was last used and from which IP.
Keep keys safe
Anyone with your key can spend your balance. Do not put keys in client-side code or public repositories. If a key may have leaked, delete it and create a new one.
- Use a separate key per application, so you can revoke one without affecting the others.
- Set a quota or rate limit on keys used for testing or by third parties.
- Use an IP whitelist for servers with fixed addresses.