Standard Compute Authentication

generated: '2026-09-02'
method: searched
source: https://standardcompute.com/getting-started
docs: https://standardcompute.com/getting-started
also:
  - https://standardcompute.com/security
  - https://standardcompute.com/support
  - probed: POST https://api.stdcmpt.com/v1/chat/completions (no key) -> HTTP 401
summary: >-
  Single-credential Bearer API key. There is no OAuth, no OIDC, no mTLS and no
  scope model — one long-lived account key authenticates every operation on
  https://api.stdcmpt.com/v1. Because the surface is OpenAI-wire-compatible, the
  key is supplied exactly the way an OpenAI key is, which is the whole point:
  agents swap the base URL and the key and nothing else changes.
schemes:
  - id: bearerApiKey
    type: http
    scheme: bearer
    in: header
    header: Authorization
    format: "Authorization: Bearer <key>"
    key_prefix: sc_live_
    key_prefix_source: https://standardcompute.com/getting-started
    issued_from: dashboard (https://standardcompute.com/dashboard)
    rotation: >-
      Plaintext key is displayed exactly once at creation; only an encrypted blob
      and the last four characters are retained afterwards, and the provider states
      there is no administrative path to recover the plaintext. Rotation therefore
      means issuing a new key.
    storage_guidance: >-
      Docs instruct storing the key in the platform secrets store rather than
      hardcoding it.
    applies_to:
      - POST /v1/chat/completions
      - POST /v1/completions
      - POST /v1/responses
      - POST /v1/messages
      - POST /v1/messages/count_tokens
anonymous_operations:
  - path: /v1/models
    method: GET
    note: >-
      Confirmed unauthenticated on 2026-09-02 (HTTP 200, model list returned). The
      provider's own status page documents this as the self-service uptime check.
  - path: /install.sh
    method: GET
    note: Setup script, served without authentication (HTTP 200).
  - path: /install.ps1
    method: GET
alternate_env_conventions:
  - description: >-
      OpenAI-compatible agents read the standard OpenAI variables.
    variables:
      OPENAI_BASE_URL: https://api.stdcmpt.com/v1
      OPENAI_API_KEY: "<Standard Compute key>"
      OPENAI_MODEL: standardcompute
  - description: >-
      Anthropic-compatible agents (Claude Code) read the Anthropic variables, and
      the base URL deliberately drops the /v1 suffix because the client appends
      /v1/messages itself.
    variables:
      ANTHROPIC_BASE_URL: https://api.stdcmpt.com
      ANTHROPIC_API_KEY: "<Standard Compute key>"
    source: https://standardcompute.com/integrations/claude-code
key_verification:
  method: HMAC-SHA256 over the submitted key compared against the stored hash
  constant_time_compare: true
  at_rest_encryption: AES-256-GCM, per-account derived key stored separately
  brute_force_control: failed authentication attempts are rate limited
  source: https://standardcompute.com/security
transport:
  tls_minimum: '1.2'
  plaintext_http: refused (not redirected or downgraded)
  profile: Mozilla Intermediate
  source: https://standardcompute.com/security
failure_modes:
  - status: 401
    body: '{"error": {"message": "Invalid API key", "type": "invalid_request_error"}}'
    observed: '2026-09-02'
    note: Observed live against POST /v1/chat/completions with no Authorization header.
gaps:
  - >-
    The published OpenAPI (https://api.stdcmpt.com/openapi.json) declares NO
    components.securitySchemes and no security requirement on any operation, even
    though every /v1 completion path requires a Bearer key. An agent reading only
    the spec would believe the API is anonymous. This is captured as a correction
    in overlays/standard-compute-openapi-overlay.yaml and is the single highest-value
    fix the provider could make to their contract.