API Keys
Send your key, give each app its own spending limit and model list, and read rate-limit headers.
Create and manage keys on the API keys page. Give each app or environment its own key: you can then cap its spending, limit it to certain models, or revoke it without touching the others.
Send the key
Every endpoint accepts the key in either of these headers, so the OpenAI and Anthropic SDKs work as they are:
-H "Authorization: Bearer $OHMYGPT_API_KEY" # OpenAI SDKs, curl
-H "x-api-key: $OHMYGPT_API_KEY" # Anthropic SDK, Claude CodeThe Gemini generateContent endpoint also accepts x-goog-api-key, the header the Google GenAI SDK sends. Send the key in one header only.
Key settings
Each key has its own settings, checked on every request:
| Setting | What it does | Response once it applies |
|---|---|---|
| Spending limit | Stops the key once it has spent this much | 402 api_key_spend_limit_exceeded |
| Allowed models | Restricts the key to the models you list | 403 model_not_allowed |
| Expiry date | Stops the key after this date | 401 api_key_expired |
| Enabled | Switches the key off without deleting it | 401 api_key_disabled |
A request stopped by a key setting costs nothing, and the message says which setting to change:
{
"error": {
"param": "model",
"code": "model_not_allowed",
"message": "This API key cannot use the model `openai/gpt-5.4-nano`. Update the key's allowed models at https://www.ohmygpt.com/keys.",
"type": "permission_error"
}
}All keys draw on your account balance. When the balance runs out, calls return 402 insufficient_credits; top up on the Billing page and they work again.
Rate limits
Your account has a requests-per-minute limit, shared by all its keys. It rises with your total top-ups:
| Total top-ups | Requests per minute |
|---|---|
| Below ¥20 | 60 |
| ¥20 or more | 1,000 |
| ¥300 or more | 10,000 |
GET /v1/me returns your current limit and the next step up:
curl https://api.ohmygpt.com/v1/me -H "Authorization: Bearer $OHMYGPT_API_KEY"{
"rpm": 60,
"recharge_band": "normal",
"next_recharge_band": "vip",
"next_recharge_rpm": 1000,
"next_recharge_threshold_cny": 20
}Model endpoints report where you stand on each response:
X-RateLimit-Limit-Requests: 60
X-RateLimit-Remaining-Requests: 59
X-RateLimit-Reset-Requests: 1sX-RateLimit-Reset-Requests is the time until the limit resets, written as a duration such as 1s or 500ms. Over the limit, calls return 429 rate_limit_exceeded with a Retry-After header in seconds; wait that long, then send the request again.