Keys and authentication
Every person and app gets a Sovereign key. It is the only key they need.
Kinds of key
| Kind | Starts with | Used for |
|---|---|---|
| Person | sov_live_ |
A person's tools: Claude Code, Codex, scripts, notebooks. |
| App | sov_live_ |
A service or product that calls models. |
| Admin | sov_admin_ |
The dashboard API only. Admin keys can't make model calls. |
Keys are created on the Keys page of the dashboard, shown once, and stored only as a hash. Revoking a key takes effect
within 30 seconds; requests with it then get a 401.
Sending the key
Send the key the way your SDK already sends one. Sovereign accepts all three:
| Header | Sent by |
|---|---|
Authorization: Bearer sov_live_… |
OpenAI SDKs, most frameworks, Claude Code with ANTHROPIC_AUTH_TOKEN |
x-api-key: sov_live_… |
Anthropic SDKs, Claude Code with ANTHROPIC_API_KEY |
api-key: sov_live_… |
Azure-style clients |
Provider keys
Your company's requests are answered through its own provider accounts. An admin connects them once, on the Keys page: pick the provider, paste the key, and Sovereign checks it with the provider before saving it, encrypted.
| Connect | Reaches | Serves |
|---|---|---|
| OpenRouter | every model | Anthropic Messages, Chat Completions, Responses |
| OpenAI | OpenAI's models | Chat Completions, Responses |
| Anthropic | Anthropic's models | Anthropic Messages, Chat Completions |
| Google's models | Chat Completions | |
| xAI | xAI's models | Anthropic Messages, Chat Completions, Responses |
| Mistral | Mistral's models | Chat Completions |
| DeepSeek | DeepSeek's models | Anthropic Messages, Chat Completions |
| Amazon Bedrock | the models your AWS account lists | Claude in Anthropic Messages; GPT, DeepSeek, Mistral, Qwen and others in Chat Completions (and Responses for OpenAI's) |
| Azure AI Foundry | your deployments | Claude in Anthropic Messages; OpenAI's models in Chat Completions and Responses; others in Chat Completions |
| Google Vertex AI | Gemini and Claude in your project | Claude in Anthropic Messages; Gemini in Chat Completions |
- The Models page follows your keys. With only an OpenAI key, you see and use OpenAI's models; add OpenRouter or another provider's key and their models appear.
- A provider's own key wins. When both OpenRouter and, say, OpenAI are connected, OpenAI's models are sent to OpenAI directly and billed to your OpenAI account; everything else goes through OpenRouter.
- Claude Code needs a key that speaks Anthropic's format: Anthropic, OpenRouter, xAI, DeepSeek, or Claude on Bedrock, Azure or Vertex.
Your cloud accounts
If your company buys AI through its cloud, connect the cloud account instead of a key, and model spend counts against the commitments you already have. Each takes a few fields:
| Cloud | You enter |
|---|---|
| Amazon Bedrock | A Bedrock API key and its region, like us-east-1. Sovereign reads the models your account can use, in that region or through Bedrock's cross-region inference profiles. A long-term key works only in the region it was made in. |
| Azure AI Foundry | The resource name (or its endpoint URL), the resource key, and your deployment names. Write name=model when a deployment isn't named after its model, like prod-claude=claude-opus-5-5. |
| Google Vertex AI | A service account key file (JSON) with the Vertex AI User role, the location (global unless you need a region), and, optionally, the models enabled in Model Garden. |
People and apps never hold a provider key: they only ever use their Sovereign key.
Teams and budgets
A key can belong to a team. A team can have a monthly budget: once a team has spent it, its requests keep working and move to cheaper models for the rest of the month. Spend per team is on the Teams page.