Create and protect an API key
API keys connect requests to your SayGM account and prepaid credit balance.
Create a key
Section titled “Create a key”- Sign in at saygm.com.
- Open API keys in the dashboard.
- Create a key and give it a name that identifies the application or environment.
- Copy the key when it is displayed.
Store the value in a secret manager or local environment variable:
export GM_API_KEY="gm_live_…"Use separate keys
Section titled “Use separate keys”Create separate keys for production, development, CI, and each application. This makes usage easier to attribute and lets you revoke one application without interrupting the others.
Keep keys secret
Section titled “Keep keys secret”- Never commit keys to source control.
- Never put a key in browser-side JavaScript or a mobile application bundle.
- Never paste a key into an issue, screenshot, chat, or support request.
- Load server-side keys from environment variables or a secret manager.
If a key may have been exposed, revoke it in the dashboard and replace it immediately. Rotation is complete only after the old key has been revoked.
Authentication headers
Section titled “Authentication headers”Different compatibility surfaces follow their native conventions:
| Surface | Authentication |
|---|---|
| OpenAI-compatible | Authorization: Bearer <saygm-key> |
| Anthropic Messages | x-api-key: <saygm-key> |
| Gemini | Authorization: Bearer <saygm-key>, x-goog-api-key: <saygm-key>, or ?key=<saygm-key> |
Official SDKs set these headers when you pass the SayGM key through their normal
api_key or apiKey option.
Verify a key’s credits
Section titled “Verify a key’s credits”After exporting the key, query its current spendable balance:
curl -fsS "https://api.saygm.com/v1/credits" \ -H "Authorization: Bearer $GM_API_KEY"This returns the key’s current spendable balance. See
check balance and current spend
for the response fields. A 401 means the key is missing or invalid.