Authentication
Learn how to authenticate your API requests to GonkaGate.
Overview
GonkaGate uses two authentication methods depending on the endpoint type:
API Key Authentication
For all /v1/* endpoints (Chat Completions, Models). Use Bearer token in Authorization header.
/v1/*Getting Your API Key
Follow these steps to get your API key:
Warning
Important: Save Your Key: Your API key is shown only once when created. Copy and save it immediately in a secure location. If lost, you'll need to regenerate a new key.
Using Your API Key
Include your API key in the Authorization header of all API requests:
HTTP Header
Authorization: Bearer gp-your-api-key-hereAPI Key Format
GonkaGate API keys always start with 'gp-' prefix
gp-*Code Examples
Here's how to use your API key in different languages:
python
from openai import OpenAI
client = OpenAI(
base_url="https://api.gonkagate.com/v1",
api_key="gp-your-api-key-here" # Get from dashboard
)
response = client.chat.completions.create(
model="Qwen/Qwen3-235B-A22B-Instruct-2507-FP8",
messages=[{"role": "user", "content": "Hello!"}]
)
print(response.choices[0].message.content)Security Best Practices
Follow these practices to keep your API key secure:
- Never expose in frontend code — Never include your API key in client-side JavaScript. It will be visible in browser dev tools.
- Use environment variables — Store your API key in environment variables, not in source code.
- Regenerate if compromised — If you suspect your key is compromised, regenerate it immediately from the dashboard.
Using Environment Variables
python
import os
from openai import OpenAI
# Read from environment variable
client = OpenAI(
base_url="https://api.gonkagate.com/v1",
api_key=os.environ.get("GONKAGATE_API_KEY")
)
# Now use client as normal
response = client.chat.completions.create(
model="Qwen/Qwen3-235B-A22B-Instruct-2507-FP8",
messages=[{"role": "user", "content": "Hello!"}]
)Regenerating API Key
You can regenerate your API key at any time from the dashboard. This is useful if your key is compromised or you want to rotate keys.
Immediate Invalidation
When you regenerate your API key, the old key stops working immediately. Make sure to update all your applications with the new key.
Key Takeaways
- Always store API keys in environment variables, never in source code
- Handle 401 (invalid key) and 402 (insufficient balance) errors gracefully
- Regenerate your key immediately if you suspect it's compromised
- Never expose API keys in frontend/client-side code