Authentication and scopes

Send OpenPond API keys as a bearer token from server-side code:

http

Authorization: Bearer OPENPOND_API_KEY

Hosted models

Request	Required scope
`GET /opchat/v1/models`	`opchat:model:read`
`GET /opchat/v1/models/{model}`	`opchat:model:read`
`POST /opchat/v1/chat/completions`	`opchat:chat:create`

Sandboxes

Sandbox operations use granular sandbox:* scopes. Use the smallest scope that matches the resource and action rather than granting broad access by default.

API keys are credentials. Do not place them in client-side code, logs, screenshots, browser storage, prompts, or public repositories.

Next: OpenAI-compatible Models API.