# API Keys (/docs/api-keys)

Create and manage keys on the [API keys](https://www.ohmygpt.com/keys) page. Give each app or environment its own key: you can then cap its spending, limit it to certain models, or revoke it without touching the others.

## Send the key [#send-the-key]

Every endpoint accepts the key in either of these headers, so the OpenAI and Anthropic SDKs work as they are:

```bash
-H "Authorization: Bearer $OHMYGPT_API_KEY"   # OpenAI SDKs, curl
-H "x-api-key: $OHMYGPT_API_KEY"              # Anthropic SDK, Claude Code
```

The Gemini `generateContent` endpoint also accepts `x-goog-api-key`, the header the Google GenAI SDK sends. Send the key in one header only.

## Key settings [#key-settings]

Each key has its own settings, checked on every request:

| Setting | What it does | Response once it applies |
|---|---|---|
| Spending limit | Stops the key once it has spent this much | `402 api_key_spend_limit_exceeded` |
| Allowed models | Restricts the key to the models you list | `403 model_not_allowed` |
| Expiry date | Stops the key after this date | `401 api_key_expired` |
| Enabled | Switches the key off without deleting it | `401 api_key_disabled` |

Allowed models can include models that aren’t available yet. Once one is enabled, the key can call it right away.

A request stopped by a key setting costs nothing, and the message says which setting to change:

```json
{
  "error": {
    "param": "model",
    "code": "model_not_allowed",
    "message": "This API key cannot use the model `openai/gpt-5.4-nano`. Update the key's allowed models at https://www.ohmygpt.com/keys.",
    "type": "permission_error"
  }
}
```

All keys draw on your account balance. When the balance runs out, calls return `402 insufficient_credits`; top up on the [Billing](https://www.ohmygpt.com/billing) page and they work again.

## Rate limits [#rate-limits]

Your account has a requests-per-minute limit, shared by all its keys. It rises with your total top-ups:

| Total top-ups | Requests per minute |
|---|---|
| Below ¥20 | 60 |
| ¥20 or more | 1,000 |
| ¥300 or more | 10,000 |

`GET /v1/me` returns your current limit and the next step up:

```bash
curl https://api.ohmygpt.com/v1/me -H "Authorization: Bearer $OHMYGPT_API_KEY"
```

```json
{
  "rpm": 60,
  "recharge_band": "normal",
  "next_recharge_band": "vip",
  "next_recharge_rpm": 1000,
  "next_recharge_threshold_cny": 20
}
```

Model endpoints report where you stand on each response:

```http
X-RateLimit-Limit-Requests: 60
X-RateLimit-Remaining-Requests: 59
X-RateLimit-Reset-Requests: 1s
```

`X-RateLimit-Reset-Requests` is the time until the limit resets, written as a duration such as `1s` or `500ms`. Over the limit, calls return `429 rate_limit_exceeded` with a `Retry-After` header in seconds; wait that long, then send the request again.