Every request is authenticated with an API key. Send it as a Bearer token:
Authorization: Bearer gsk_live_xxx
The x-api-key: gsk_live_xxx header is also accepted if a Bearer token is inconvenient in your stack.
Key format
Keys look like gsk_live_<id>_<secret>:
gsk_live_…— a live key for production traffic.gsk_test_…— a test key, if you were issued one.
The full secret is shown once at creation. GREM stores only a hash, so a lost key cannot be recovered — create a new one and revoke the old.
Managing keys
In the cabinet, AI tools → API → Keys lets you:
- Create a key (with an optional label).
- Revoke a key — it stops working immediately and permanently.
Use separate keys per integration or environment and give them clear labels. Revoking one then never disrupts the others.
Scopes
Each key carries scopes that limit which tools it may call (for example tools:valuation, tools:contentgen, webhooks). A call to a tool the key isn't scoped for returns 403 — see Errors.
Keeping keys safe
Never expose an API key in front-end code, a public repository, or a URL. Anyone with the key can spend from your account. If a key leaks, revoke it immediately and issue a new one.
- Store keys in server-side environment variables or a secrets manager.
- Rotate keys periodically.
- Requests must use HTTPS; plain HTTP is not supported.