API key checker

Every AI provider has a cheap way to ask “do you recognise this key?”: an endpoint that needs a valid key but doesn’t generate any text. For OpenAI, Anthropic, Google, Groq and Mistral that’s the list models endpoint; for OpenRouter it’s the current key endpoint, which also reports the key’s credit limit and usage. The checker makes exactly one of these requests, from your browser, and reads the answer. No tokens are generated, so there’s nothing to bill.

How the answer is read

A successful reply means the key is valid, and the list that comes back shows which models it can use. When the request fails, the HTTP status and the provider’s own error type decide the result:

• Invalid (usually 401): the provider doesn’t recognise the key. It may be incomplete, revoked, expired or from another provider. Google reports a bad key as a 400 with the reason API_KEY_INVALID.
• No access (403, or 402 and quota errors): the key is real but can’t do this, for example a restricted OpenAI key without permission to read models, a Google key limited to other APIs, or an account with no credit.
• Rate-limited (429): the provider is throttling the key. That normally means the key itself was accepted.
• Couldn’t connect: no answer reached the page. Browsers report blocked requests, CORS refusals and being offline in the same way, so the checker says so plainly instead of guessing.
• Provider error (5xx): the provider had a problem, so the key couldn’t be judged.

Whatever the outcome, the provider’s own message is shown too, with your key removed from it.

What happens to your key

The key never touches this site’s server. Your browser calls the provider directly, which works because all six allow requests from web pages (Anthropic only when the request includes its anthropic-dangerous-direct-browser-access header, which the checker sends). The key is sent in a request header, never in the URL, so it can’t end up in browser history or server logs the way a ?key= parameter can. Requests carry no cookies and no referrer.

This page’s Content Security Policy lists the only addresses scripts may connect to: this site, the six provider APIs and Cloudflare’s cookie-less analytics, which never receives your key. Unlike the token counter and the Gemini playground, the checker has no “remember” option: the key lives in the page’s memory until you clear it or leave. See the privacy policy for the full details.

A safety catch for the wrong provider

Several providers use recognisable prefixes: Anthropic keys start with sk-ant-, OpenRouter keys with sk-or-, Groq keys with gsk_. If you paste a key that clearly belongs to a different provider from the one selected, the checker stops before sending anything and asks, because a key sent to the wrong company has been shown to that company. Mistral doesn’t document a key format, so its keys are never second-guessed. A key is never rejected just for its format.

What a valid result doesn’t prove

A key can be valid and still fail on real requests. OpenAI and Anthropic need prepaid credit before generation works, free tiers have daily limits, and some models are only available on higher tiers. Use the LLM cost calculator to see what your usage will cost, or try a free Gemini key in the Gemini playground.