> ## Documentation Index
> Fetch the complete documentation index at: https://docs.derestricted.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create, store, and revoke keys for API access.

Inference requests use an API key created in the [console](https://derestricted.ai/console/). Your Clerk browser session signs you into the console; it is not an inference API credential.

## Create a key

1. Sign in and verify your primary email address.
2. Open **API keys** and choose **Create API key**.
3. Give it a useful name, such as `local-development` or `production-server`.
4. Copy the full key while it is displayed. Later visits show only a masked value.

Keys start with `glmk_`. The current limit is five active keys per account. Revoke an unused key before creating another when you reach that limit.

## Send the key

The API accepts either of these headers:

<CodeGroup>
  ```http Bearer token theme={"system"}
  Authorization: Bearer glmk_your_key_here
  ```

  ```http Anthropic-style header theme={"system"}
  x-api-key: glmk_your_key_here
  ```
</CodeGroup>

Use one header. If you send both, their values must match. The OpenAI SDK sends the Bearer header; the Anthropic SDK sends `x-api-key`.

```bash theme={"system"}
export DERESTRICTED_API_KEY='glmk_your_key_here'
```

Read this variable from your server process or development tool. Do not put a key in a URL, public website code, or a committed configuration file.

## Account access and credit

An API key must belong to an active account with a verified email. New verified console accounts receive a one-time **\$5 starting credit** when their billing account is first provisioned. This grant is per new account, does not refill after use, and does not retroactively top up existing accounts.

Keys on the same account share its balance. Creating or replacing a key does not create a new balance. If credit is still activating, the API can return `503` with `credit_pending`. If there is insufficient available credit for a request, it returns `402`.

View your balance and request additional credit in the [console](https://derestricted.ai/console/).

## Rotate or revoke a key

Create a replacement, update the applications that use it, then revoke the old key in the console. A revoked key cannot authenticate new requests. If you lose a key, replace it; the console cannot reveal an existing key again.

If a key was exposed, revoke it promptly. Never use a Clerk secret key or an administrator credential as an inference key.

## Check authentication failures

| Status | What to check                                                                        |
| ------ | ------------------------------------------------------------------------------------ |
| `401`  | Missing, malformed, expired, or revoked API key; conflicting authentication headers. |
| `403`  | Account is inactive or its email is unverified.                                      |
| `402`  | Key authenticated, but available credit is insufficient.                             |

See [the error reference](/api/errors) for retry behavior and streaming errors.