Skip to main content
Aria Compute ROUTER has two authentication surfaces. The data plane uses OpenAI-style Authorization: Bearer <router-key> headers. The management plane accepts either a session cookie from login, an X-Api-Key header, or an Authorization: Bearer <session-token> headerhas two authentication surfaces. The data plane uses OpenAI-style Authorization: Bearer <router-key> headers. The management plane accepts either a session cookie from login, an X-Api-Key header, or an Authorization: Bearer <session-token> header. Public routes that never require authentication include /health, /v1/router/version, /v1/router/auth/register, /v1/router/auth/register-status, /v1/router/auth/login, and /v1/router/auth/oauth/callback. Public routes that never require authentication include /health, /v1/router/version, /v1/router/auth/register, /v1/router/auth/register-status, /v1/router/auth/login, and /v1/router/auth/oauth/callback.

​
Data plane authenticationData plane authentication

Inference endpoints (/v1/chat/completions and /v1/models) require a router API key. Pass it in the Authorization header as a Bearer tokenInference endpoints (/v1/chat/completions and /v1/models) require a router API key. Pass it in the Authorization header as a Bearer token.
Create and revoke router keys via the management plane at /v1/router/keys.Create and revoke router keys via the management plane at /v1/router/keys.

​
Management plane authentication

Management routes under /v1/router/* support three authentication methods:
  1. Session cookie: Log in via /v1/router/auth/login to receive a Set-Cookie response with aria_router_session. Include the cookie on subsequent requests.
  2. X-Api-Key header: Pass your API key in the X-Api-Key header.
  3. Authorization: Bearer: Pass a valid session token with a non-key prefix (keys start with sk-aria_ or sk-bf-; session tokens are hex strings and are resolved to users instead of API keys).
Example with a session cookie:
Example with X-Api-Key:
If the router has no local users configured yet, the management plane is open (no authentication required) so you can run the initial setup.

​
Management plane authentication

Management routes under /v1/router/* support three authentication methods:
  1. Session cookie: Log in via /v1/router/auth/login to receive a Set-Cookie response with aria_router_session. Include the cookie on subsequent requests.
  2. X-Api-Key header: Pass your API key in the X-Api-Key header.
  3. Authorization: Bearer: Pass a valid session token with a non-key prefix (keys start with sk-aria_ or sk-bf-; session tokens are hex strings and are resolved to users instead of API keys).
Example with a session cookie:
Example with X-Api-Key:
If the router has no local users configured yet, the management plane is open (no authentication required) so you can run the initial setup.