Every request to the public API is authenticated with a per-account API key sent as a bearer token.
API keys are created and managed from the dashboard, which requires a free IsraelGPT account (email/password or Google). There is no separate developer application process — sign in, name a key, and it's issued immediately.
You can have up to 5 active keys per account at a time. Revoke one to make room for another.
Each key has a Media toggle in the dashboard, on by default. Turn it off for an integration that only handles plain text — the model is instructed not to emit [IMAGE]/[podcast]/[music] tags at all, any that slip through anyway are stripped from reply, and media is never resolved or returned. Flip it back on any time; it applies to the next request, no propagation delay.
More per-key settings will land here over time as they're added.
Every request needs an Authorization header:
Authorization: Bearer igpt_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxA missing header returns 401 missing_api_key. An invalid, mistyped, or revoked key returns 401 invalid_api_key. Neither response distinguishes "wrong key" from "revoked key" from "never existed" — that's deliberate, so a guessing attacker can't use the error to narrow down valid key formats.
Keys look like igpt_live_ followed by 32 random URL-safe characters. Only a cryptographic hash of your key is ever stored server-side — the plaintext is shown to you exactly once, at creation time, in the dashboard. If you lose it, there is no way to retrieve it again; revoke it and create a new one.
| Do | Don't |
|---|---|
| Keep it server-side (env var, secrets manager) | Don't put it in client-side/browser JavaScript |
| Use one key per app/bot/integration | Don't share one key across unrelated projects |
| Revoke a key the moment you suspect it leaked | Don't commit a key to a public git repository |
| Rotate keys periodically for anything long-running | Don't reuse a key across accounts or team members |
A leaked key can be used by anyone to consume your rate limit and generate content attributed to your account. If a key leaks, revoke it from the dashboard immediately — revocation takes effect on the next request, no propagation delay.
Every call identifies you as an account, not as a "logged in" or "guest" session the way the web chat does. There's no separate anonymous/guest tier for the API — a key is always tied to a real account, so every API caller has full access to whatever the account tier allows (see Rate Limits).