GeraikitaGeraikita AI
MenuAuthentication

Authentication

Every request is authenticated with your API key, which starts with gk-. Costs are deducted from the GeraiPoints balance of the account that owns the key.

Sending the API key

Send the key in one of the following headers. Both work on all paid endpoints.

HeaderFormatNotes
AuthorizationBearer gk-…Default for OpenAI-format clients (https://ai.geraikita.com/v1).
x-api-keygk-…Default for Anthropic-format clients (https://ai.geraikita.com).
anthropic-version2023-06-01Sent automatically by the Anthropic SDK; include it when calling /v1/messages directly.
HTTP headers
# OpenAI
Authorization: Bearer gk-xxxxxxxx

# Anthropic
x-api-key: gk-xxxxxxxx
anthropic-version: 2023-06-01

If the key is missing, wrong, or revoked, the server responds with 401 and type authentication_error:

401 Unauthorized
{
  "error": {
    "message": "API key tidak valid atau tidak dikenali. Pastikan key gk- kamu benar.",
    "type": "authentication_error",
    "code": null
  }
}

Creating & revoking keys

  1. Open the Dashboard and choose Create API key.
  2. Give it a name that describes its use (e.g. laptop-kantor or server-produksi) and, if needed, choose which models it may use.
  3. Copy the key and store it somewhere safe. To revoke it, press Revoke in the key list — requests with that key are rejected immediately.
The raw key is shown only once when created and cannot be viewed again. Up to 20 active keys per account — revoke an old key to create a new one.

Restricting a key to specific models

Each key can be restricted to a specific list of models (allowlist). An empty list means all models are allowed. Requests to models outside the list get 403 permission_error, and GET /v1/models with that key only shows the allowed models. Use this for keys shared with apps or teams to keep costs under control.

Key types

KeyForBase URL
gk-Paid API — deducted from GeraiPoints. Created in the Dashboard.https://ai.geraikita.com/v1
gk- (bansos)Free tier — daily quota, separate endpoint. See Free tier (Bansos). It cannot be used on paid endpoints, and vice versa.https://ai.geraikita.com/v1/claude
gkr-Reseller program — managed on the Reseller page.—

Keeping keys secure

  • Never put keys in front-end code (browsers, mobile apps). Call the API from your own server.
  • Store keys in environment variables or a secret manager, and never commit them to a repository.
  • Use one key per app or device, so usage is easy to track and a single key can be revoked without affecting the others.
  • Suspect a key has leaked? Revoke it right away in the Dashboard and create a new one.