Anthropic now takes the key as Authorization: Bearer, and still accepts the x-api-key header shown here. Every request also needs the anthropic-version header, or it fails. The SDK reads ANTHROPIC_API_KEY.
OpenAI takes Authorization: Bearer, and the SDK reads OPENAI_API_KEY.
Gemini takes x-goog-api-key, and the SDK reads GEMINI_API_KEY or GOOGLE_API_KEY. Gemini also accepts ?key= in the URL. URLs land in logs and proxies, so prefer the header.
The same models on Amazon Bedrock or Google Cloud use the cloud's own identity and access management (IAM) credentials instead. That means SigV4 request signing or a short-lived OAuth token.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
Why would a team call Claude or Gemini through Bedrock or Google Cloud instead of with a provider API key?Names short-lived credentials instead of a static secret, access controlled by existing IAM roles and policies, and billing on the cloud account.
A request fails with an authentication error. Should your client retry it, and what do you check first?Auth errors are permanent, so fail fast and alert instead of retrying. Check the key is set, not revoked, and sent in the header that provider expects.
How would you manage and rotate LLM API keys across several teams and environments?Covers a secrets manager, separate keys per team and environment, rotation without downtime, and spend limits per project or workspace.
What does the anthropic-version header do, and who sets it when you use the SDK?It pins the API behavior your code was written against, so later changes don't break it. The SDK sends it for you, and raw HTTP calls must add it.
What you can say
All three use the same basic scheme. You send a long-lived secret API key in a request header, and only the header name and a few extras differ.
OpenAI takes it as Authorization: Bearer, and the SDK picks it up from OPENAI_API_KEY.
Anthropic's classic header is x-api-key, and it now accepts a Bearer token too. Every request also needs an anthropic-version header or it fails, and the SDK reads ANTHROPIC_API_KEY.
Gemini uses x-goog-api-key, and its SDK reads GEMINI_API_KEY or GOOGLE_API_KEY. It also accepts ?key= in the URL, but I'd avoid that because URLs end up in logs and proxies.
On Amazon Bedrock or Google Cloud, the same models use the cloud's IAM credentials instead, which means SigV4 request signing or a short-lived OAuth token.
The trade-off is that a static key is simple, but a leaked one works until someone revokes it. So I keep it server-side, while IAM takes more setup but gives short-lived credentials.
Weak answers to avoid
Says every provider uses a Bearer tokenGemini expects x-goog-api-key, and most Anthropic code sends x-api-key. Naming each header shows you have called these APIs yourself.
Forgets the anthropic-version headerAnthropic rejects a request without it. Mention it along with the key, since it is the extra header that breaks hand-written HTTP calls.
Puts the key in the URL or in client codeQuery strings end up in logs and proxies, and client code ships the key to every user. Send it in a header from your own server.
Ignores Bedrock and Google Cloud accessMany companies reach these models through their cloud account, where IAM replaces the provider key. Say it switches to SigV4 signing or short-lived OAuth tokens.
Interview lens
Likely follow-ups, what you can say, and the weak answers to avoid.
