generated: '2026-08-26'
method: searched
source: https://www.tokenrouter.com/docs/management-api-documentation/
name: PaleBlueDot.AI / PBD TokenRouter authentication
note: >-
  Derived from the provider's published Management API reference and the agent-setup
  guides, then confirmed against live unauthenticated responses. There is no published
  OpenAPI document, so these schemes are transcribed from prose docs and from observed
  401 bodies rather than from a machine-readable securitySchemes block.
ownership_note: >-
  TokenRouter is on a different domain from palebluedot.ai. It is PaleBlueDot AI's own
  product: PaleBlueDot AI announced PBD TokenRouter by press release, tokenrouter.com's
  footer links to PaleBlueDot AI's LinkedIn/YouTube/X accounts, and the gateway's own
  anonymous https://api.tokenrouter.com/api/status response embeds
  "https://www.palebluedot.ai/open/chat/" and a palebluedot.ai logo URL. The TokenRouter
  Terms of Use name Artemis Tokenrouter Inc. as the operating entity.
hosts:
- https://api.tokenrouter.com
schemes:
- id: inference_api_key
  type: http
  scheme: bearer
  in: header
  header: Authorization
  format: 'Bearer <API_KEY>'
  key_prefix: sk-
  key_format: sk-xxxxxxxxxxxxxxxx
  applies_to: Inference API (/v1/chat/completions, /v1/responses, /v1/messages, /v1beta/..., /v1/images/generations, /v1/video/generations)
  issued_via: TokenRouter Console -> API Keys -> Create Key
  scoped: false
  notes:
  - Anthropic-compatible clients pass the same key as ANTHROPIC_AUTH_TOKEN with ANTHROPIC_BASE_URL=https://api.tokenrouter.com (no /v1 suffix).
  - OpenAI-compatible clients use base URL https://api.tokenrouter.com/v1.
  - Per-key spend quota and enable/disable state are managed through the Management API.
  source: https://www.tokenrouter.com/docs/openclaw-setup/
- id: management_key
  type: http
  scheme: bearer
  in: header
  header: Authorization
  format: 'Bearer <YOUR_MANAGEMENT_KEY>'
  applies_to: Management API (/api/management/*)
  middleware: ManagementKeyForAuth
  distinct_from_inference_key: true
  notes:
  - A Management Key is a separate credential from an inference API key; it resolves to its owning user and, for enterprise super administrators, to the whole organization.
  - Keys carry a status (enabled/disabled) and an ExpiresTime.
  source: https://www.tokenrouter.com/docs/management-api-documentation/
oauth2: false
openid_connect: false
mutual_tls: false
scopes_published: false
scopes_note: >-
  No OAuth2 or scope surface is published. The gateway's own /api/status response reports
  oidc_enabled false, github_oauth false, discord_oauth false and wechat_login false,
  so scopes/ is intentionally not emitted.
failure_modes:
- http_status: 401
  message: No Authorization request header provided
  cause: Missing Authorization header.
- http_status: 401
  message: management key is invalid
  cause: Key not found or soft-deleted.
- http_status: 403
  message: management key has been disabled
  cause: Key status is not enabled.
- http_status: 403
  message: management key has expired
  cause: Key past its ExpiresTime.
- http_status: 403
  message: User has been banned
  cause: Owning user is not enabled.
x-evidence:
- url: https://api.tokenrouter.com/api/management/api-keys
  method: GET
  http_status: 401
  body: '{"message":"No Authorization request header provided","success":false}'
  note: Live unauthenticated response matches the documented failure message verbatim.
  fetched: '2026-08-26'
- url: https://api.tokenrouter.com/v1/models
  method: GET
  http_status: 401
  body: '{"error":{"code":"","message":"Token not provided (request id: ...)","type":"api_error"}}'
  fetched: '2026-08-26'
- url: https://api.palebluedot.ai/
  method: GET
  http_status: 401
  body: '{"error": {"message": "invalid or missing API key", "type": "authentication_error"}}'
  note: A second, separately-branded gateway host also owned by the provider; every path returns this same 401, so no anonymous discovery is possible there.
  fetched: '2026-08-26'