# Endpoints, authentication and protocols

## Base URL
Use this base URL for the OpenAI-compatible API:
```text
https://api.aoxtoken.com/v1
```
If a client appends the endpoint itself, enter only the base URL. Do not append `/responses` or `/chat/completions` again.

## HTTP authentication
```http
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json
```
Replace the placeholder with your key. Do not put keys in URL query parameters.

## API formats and transports
| Name | Purpose |
| --- | --- |
| Chat Completions | Conversation request format using messages |
| Responses | Response request format using input |
| HTTPS | Encrypted HTTP requests |
| SSE | Events delivered within an HTTP response |
| WebSocket | Bidirectional messages over an established connection |

`wire_api = "responses"` selects an API format, not WebSocket transport. In Codex, `supports_websockets = false` disables advertising Responses WebSocket support for that provider. Actual endpoint compatibility still requires testing.

## Observed response without a key
On 2026-09-10, unauthenticated requests to the models endpoint and both generation endpoints returned HTTP 401:
```json
{"code":"API_KEY_REQUIRED","message":"API key is required in Authorization header (Bearer scheme), x-api-key header, or x-goog-api-key header"}
```
This verifies the authentication boundary only. It does not prove that a model or every API parameter is supported.