Authentication

Every request carries your key in the X-API-Key header. There is nothing to refresh and no login flow.

curl 'https://api.gapi.dev/v2/vk?url=…' \
  -H 'X-API-Key: gapi_live_your_key_here'

Getting a key

Create one in the dashboard. You can hold up to five at once.

Keeping it safe

Treat the key like a password: keep it on your server, in an environment variable. Never put it in a mobile app, a browser bundle or a public repository — anything shipped to a user can be read by that user.

Rotating without downtime

Holding several keys is what makes rotation painless. Create the new one, deploy it, confirm traffic has moved, then delete the old. Nothing goes dark in between.

Deleting a key

Deleting takes effect immediately — the next call with that key gets 401, and the row leaves your list. What you have already spent this month stays spent: the balance belongs to the account, not to the key, so deleting one gives nothing back.

What can go wrong