Authentication

Authenticated request

The same authenticated call in three clients. Only the base URL differs from an official OpenAI setup - the SDK builds the Authorization header from the key you pass.

1curl https://api.llm-gate.tech/v1/responses \2  -H "Content-Type: application/json" \3  -H "Authorization: Bearer $CHATGPT_API_KEY" \4  -d '{5    "model": "gpt-5.4-mini",6    "input": "ping"7  }'

1import os2from openai import OpenAI3 4client = OpenAI(5    api_key=os.environ["CHATGPT_API_KEY"],6    base_url="https://api.llm-gate.tech/v1",7)8 9response = client.responses.create(model="gpt-5.4-mini", input="ping")10print(response.output_text)

1import OpenAI from "openai";2 3const client = new OpenAI({4  apiKey: process.env.CHATGPT_API_KEY,5  baseURL: "https://api.llm-gate.tech/v1",6});7 8const response = await client.responses.create({9  model: "gpt-5.4-mini",10  input: "ping",11});12console.log(response.output_text);

Verify a key

The cheapest check is one small request. A 200 response means the key is valid, the base URL is right and the balance is not empty.

curl https://api.llm-gate.tech/v1/responses \
  -H "Authorization: Bearer $CHATGPT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-5.4-mini", "input": "ping"}'

{
  "id": "resp_9f2c41a8",
  "object": "response",
  "model": "gpt-5.4-mini",
  "output_text": "pong",
  "usage": {
    "input_tokens": 8,
    "output_tokens": 2,
    "total_tokens": 10
  }
}

A 401 instead means the key is wrong, revoked or the header is malformed. The table below covers each case.

Store the key in an environment variable

Never hardcode a key in source and never ship one to the browser - anything in client-side JavaScript is public. Keep it in an environment variable or your platform's secret manager and read it at runtime.

export CHATGPT_API_KEY="your_api_key_here"

setx CHATGPT_API_KEY "your_api_key_here"

Authentication errors

Failures return a JSON error body alongside the status code. These are the ones you meet in practice.

Security

A leaked key is billable to you until it is revoked, so treat it like a password.

FAQ