API Reference

Authentication

Every route reads one header. The key identifies your account, and the account is what pays.

Requests are authenticated with a key issued in your account area. It is a bearer token, which means the plain HTTP call and every client library that speaks bearer auth work without adaptation:

Authorization: Bearer sk-sl-…

The x-api-key header is not read

Not on any route, including the Messages API. Libraries that would send x-api-key must be given the key as the auth token instead — in the Python client that is auth_token, in the TypeScript one authToken. If an environment variable for the API key is set as well, clear it: most clients prefer the key over the token when both are present, and the request then arrives with no header we read.

Using a key

Keys are created and revoked in the account area. A key looks like sk-sl- followed by 43 random characters and is shown once, at creation — we store only a hash of it, so a lost key cannot be shown again, only replaced.

Make one key per project or machine. They share one balance and any ceilings set on the account, and each can be revoked on its own; a revoked key stops working at once. There is no per-key spending limit — the ceilings are set on the account and apply to all of its keys together.

ShellOpenAI libraryMessages API client

shell

curl https://api.gtokens.io/api/v1/models \
  -H "Authorization: Bearer sk-sl-your-key"

main.py

from openai import OpenAI

# The library sends a bearer token by default, so the key goes in
# as api_key and nothing else changes.
client = OpenAI(
    base_url="https://api.gtokens.io/api/v1",
    api_key="sk-sl-your-key",
)

main.py

from anthropic import Anthropic

# auth_token, NOT api_key: api_key would be sent as x-api-key,
# and that header is not read here.
client = Anthropic(
    base_url="https://api.gtokens.io",
    auth_token="sk-sl-your-key",
)

The catalogue route is the cheapest way to check a key: it needs no balance and returns the whole catalogue. Streaming uses the same header

If a key is exposed

A key is money

Anyone holding it spends your balance. Keep it out of repositories, out of client-side code and out of shared dotfiles; pass it through an environment variable or a secret store.

If a key has been exposed, revoke it in the account area and create another — that is the whole procedure, and it takes effect immediately. Keys are bound to your account and passing one to a third party is not permitted.

To tell whether an exposed key was used, look at the spend and the last-used time on the keys screen; the request log shows what was served and what it cost.

Manage keys What a 401 looks like