Management API Keys

Use a gpm-... management API key with /api/v1/keys to list, create, update, and delete regular gp-... API keys that are available through this API. Management keys are for control-plane automation in the same GonkaGate account. They do not authenticate /v1/* model requests.

Compatibility note /api/v1/keys only works with regular keys that already have an external data.hash. Older keys may not appear in list responses and may not resolve by :hash. Recreate or rotate them if you need to manage them through this API.

Use the right key type

• Regular gp-... API keys authenticate /v1/* model requests.
• Management gpm-... API keys authenticate /api/v1/keys* routes.
• Management keys can only manage regular API keys owned by the same GonkaGate account that are available through /api/v1/keys.
• read_write keys can list, create, get, update, and delete those keys.
• read_only keys can only list and get individual keys.

Use management keys when you need to:

• create one compute API key per customer, workspace, or environment
• rotate or revoke regular API keys from automation
• apply per-key USD limits
• separate staging, production, CI, and internal traffic

Create the management key once

1. Sign in to the dashboard.
2. Open Management Keys.
3. Click Create.
4. Enter a display name and confirm.
5. Copy the gpm-... secret and store it securely.

Important rules:

• The current dashboard create flow only asks for a display name. It does not expose access or expiration controls.
• GonkaGate shows the full gpm-... secret only once.
• The account must have a verified email to create management keys and to use /api/v1/keys.
• Up to 25 active management keys are allowed per account.
• Create separate management keys for production, staging, CI, and internal tooling instead of sharing one credential.

Call /api/v1/keys with a gpm-... key

Use this base URL in GonkaGate production:

https://api.gonkagate.com/api/v1/keys

On another deployment, keep /api/v1/keys and replace only the host.

Send the management key in the Bearer header:

Authorization: Bearer gpm-YOUR_MANAGEMENT_KEY

Supported operations

hash is the 64-character identifier returned in data.hash. It is not the raw gp-... key value.

Manage regular keys programmatically

const MANAGEMENT_API_KEY = "gpm-YOUR_MANAGEMENT_KEY";
const BASE_URL = "https://api.gonkagate.com/api/v1/keys";

const headers = {
  Authorization: `Bearer ${MANAGEMENT_API_KEY}`,
  "Content-Type": "application/json",
};

const listResponse = await fetch(BASE_URL, { headers });

const listWithDisabledResponse = await fetch(
  `${BASE_URL}?offset=100&include_disabled=true`,
  { headers },
);

const createResponse = await fetch(BASE_URL, {
  method: "POST",
  headers,
  body: JSON.stringify({
    name: "Customer Production Key",
    limit: 50,
    limit_reset: "monthly",
    expires_at: "2026-12-31T23:59:59Z",
  }),
});

const created = await createResponse.json();
const keyHash = created.data.hash;

const getResponse = await fetch(`${BASE_URL}/${keyHash}`, { headers });

const updateResponse = await fetch(`${BASE_URL}/${keyHash}`, {
  method: "PATCH",
  headers,
  body: JSON.stringify({
    name: "Customer Production Key v2",
    disabled: true,
    limit: null,
    expires_at: null,
  }),
});

const deleteResponse = await fetch(`${BASE_URL}/${keyHash}`, {
  method: "DELETE",
  headers,
});

On create, save both values:

• key is the one-time raw gp-... secret for the new regular API key.
• data.hash is the 64-character external identifier used by GET, PATCH, and DELETE.

Request rules that change behavior

What successful calls return

Successful /api/v1/keys calls use OpenRouter-style field names:

• GET /api/v1/keys: { data: OpenRouterKey[] }
• GET and PATCH /api/v1/keys/:hash: { data: OpenRouterKey }
• POST /api/v1/keys: { key: "gp-...", data: OpenRouterKey }
• DELETE /api/v1/keys/:hash: { deleted: true }

All limit* and usage* values are USD.

{
  "hash": "4f2f5b6f0b0e16eab8c2e55d4f2f0ce4c6f5b91f2a28f8e93b0f8c3b8b112233",
  "label": "gp-AbCd...WXYZ",
  "name": "Customer Production Key",
  "disabled": false,
  "limit": 50,
  "limit_remaining": 50,
  "limit_reset": "monthly",
  "usage": 0,
  "usage_daily": 0,
  "usage_weekly": 0,
  "usage_monthly": 0,
  "created_at": "2026-03-16T10:00:00.000Z",
  "updated_at": "2026-03-16T10:00:00.000Z",
  "expires_at": "2026-12-31T23:59:59.000Z"
}

Common failures

Failed requests keep the standard GonkaGate /api/* error envelope, even on the OpenRouter-compatible route:

{
  "success": false,
  "error": {
    "message": "Management API key is read-only",
    "statusCode": 403,
    "requestId": "req_abc123",
    "timestamp": "2026-03-16T10:00:00.000Z"
  }
}

See also

• API Error Handling when this automation moves into production and you need retry boundaries, request IDs, and support-ready failure handling.
• Authentication and API Keys for regular gp-... keys used on /v1/*.
• Quickstart if you need the first model request rather than control-plane automation.
• API Reference Overview for the public /v1 request and response contract after keys are provisioned.