Skip to main content
Every request is authenticated with an API key sent as a bearer token:
There is no separate secret or signing step — the key is the credential.

​
Getting a key

  1. Sign in to the dashboard.
  2. Create a key.
  3. Copy it once and store it somewhere safe.
A key spends against your account balance and can call the models your account is entitled to — the catalog lists what is available.

​
Several keys, one balance

An account can hold up to 10 active keys, each with a name of your choosing. They are interchangeable — same balance, same models, same limits — so the reason to hold more than one is separation: give each app, environment or teammate its own, and you can retire that one without touching anything else. The dashboard shows spend, requests and tokens per key, so you can see which app is costing what. Rate limits are per account, not per key, so splitting traffic across keys does not raise your throughput.

​
Using the key

Pass it on the Authorization header of every call. With an OpenAI SDK, set it as the api_key / apiKey:

​
Keeping keys safe

Never embed a key in client-side code, a mobile app, or a public repository. Anyone with the key can spend against your account. Call the API from your backend and keep the key in a server-side secret or environment variable.
  • Rotate a key immediately if it may have leaked — rotating replaces the secret in place, keeping the key’s name and leaving your other keys working.
  • Environment variables (e.g. PRIMALABS_API_KEY) keep keys out of source control.
  • A missing or invalid key returns 401; a key that cannot access the requested model returns 403.