Create and protect an API key

API keys connect requests to your GM account and prepaid credit balance.

Create a key

1. Sign in at saygm.com.
2. Open API keys in the dashboard.
3. Create a key and give it a name that identifies the application or environment.
4. Copy the key when it is displayed.

Store the value in a secret manager or local environment variable:

export GM_API_KEY="gm_live_…"

Use separate keys

Create separate keys for production, development, CI, and each application. This makes usage easier to attribute and lets you revoke one application without interrupting the others.

Keep keys secret

• Never commit keys to source control.
• Never put a key in browser-side JavaScript or a mobile application bundle.
• Never paste a key into an issue, screenshot, chat, or support request.
• Load server-side keys from environment variables or a secret manager.

If a key may have been exposed, revoke it in the dashboard and replace it immediately. Rotation is complete only after the old key has been revoked.

Authentication headers

Different compatibility surfaces follow their native conventions:

Surface	Authentication
OpenAI-compatible	Authorization: Bearer <gm-key>
Anthropic Messages	x-api-key: <gm-key>
Gemini	Authorization: Bearer <gm-key> or ?key=<gm-key>

Official SDKs set these headers when you pass the GM key through their normal api_key or apiKey option.