API keys authenticate calls to the model gateway. Manage them with a JWT at /v1/api-keys; never use one API key to create or revoke another.
Create a key
/v1/api-keysJWT{
"name": "production-server",
"workspace_slug": "production-app"
}| Field | Required | Rules |
|---|---|---|
name | Yes | 1–100 characters; use a name that identifies the service and environment. |
workspace_slug | No | Defaults to the account’s default workspace. The workspace must belong to the account. |
Response
{
"id": "9ef6fc45-31f8-4fe2-8f64-af2836b20c6b",
"name": "production-server",
"key": "ngm_c84efedf696b90e3bcafd7be0c35dad9d37d4fd83bf23fc4",
"key_prefix": "ngm_c84efedf",
"scopes": ["gateway:use"],
"workspace_id": "910e5104-f604-47d4-b194-3db2fbd83f76",
"created_at": "2026-07-14T12:34:26Z"
}The full key is returned exactly once. Copy it into a secret manager immediately. If it is lost, revoke the key and create a replacement; it cannot be recovered.
An account can have up to 50 active keys. Revoke unused keys before creating more.
Use a key
Send the key as a bearer token for model and gateway requests:
Authorization: Bearer ngm_...API keys can call:
GET /v1/modelsGET /v1/models/{id}POST /v1/chat/completionsGET /v1/billing/balance
Use a JWT for profile, workspace, API-key management, activity, payment, and notification endpoints. See Authentication.
List keys
/v1/api-keysJWTList responses never include the full secret:
[
{
"id": "9ef6fc45-31f8-4fe2-8f64-af2836b20c6b",
"name": "production-server",
"key_prefix": "ngm_c84efedf",
"scopes": ["gateway:use"],
"status": "active",
"workspace_id": "910e5104-f604-47d4-b194-3db2fbd83f76",
"last_used_at": "2026-07-14T13:00:00Z",
"created_at": "2026-07-14T12:34:26Z"
}
]The status is active or revoked. Nullable fields such as workspace_id, last_used_at, and revoked_at may be omitted when empty.
Rename a key
/v1/api-keys/{id}JWT{ "name": "staging-server" }Renaming changes the label only; the secret and permissions stay the same.
Revoke a key
/v1/api-keys/{id}JWTA revoked key cannot be reactivated. Any service using it will receive 401 unauthorized on the next gateway request. Create a replacement before revoking when you need a zero-downtime rotation.
Store keys safely
Use one key per service and environment so you can rotate or revoke one integration without taking down the others. Keep keys in a secret manager or deployment environment, never in a committed .env file, browser bundle, mobile app, screenshot, or application log.