API keys

Workspace keys authenticate every /v1 call. The raw secret is shown once. OpenDoor stores a SHA-256 hash and a 16-character prefix (opd_…).

Create a key

1. Open Dashboard → API keys.
2. Name it (Production, CI, Playground).
3. Leave full access on, or tick models from the live catalog.
4. Copy the secret immediately. It looks like opd_ plus hex.

The create form can also write localStorage.od_playground_api_key in that browser so Playground can reuse it.

You need an existing session to mint the first key. After that, POST /v1/keys works with a Bearer key. Dashboard POST /api/keys and the gateway both enforce getPlan(org.plan).maxApiKeys (402 at the cap). The page shows used/max for the current plan. The secret is in key on the create body and is never returned again.

bashCopy
export OPENDOOR_API_KEY=opd_…
export OPENDOOR_BASE_URL=https://opendoor-gcp.web.app

curl "$OPENDOOR_BASE_URL/v1/keys" \
  -H "Authorization: Bearer $OPENDOOR_API_KEY"

curl "$OPENDOOR_BASE_URL/v1/keys" \
  -H "Authorization: Bearer $OPENDOOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"CI"}'

DELETE /v1/keys/:id revokes a key. You cannot revoke the key used for that request.

Call the gateway

bashCopy
curl "$OPENDOOR_BASE_URL/v1/chat/completions" \
  -H "Authorization: Bearer $OPENDOOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gemma-4-26b-a4b-it",
    "messages": [{"role":"user","content":"Hello"}]
  }'

OPENDOOR_BASE_URL is the gateway origin (no /v1). The OpenAI SDK wants https://opendoor-gcp.web.app/v1 instead. See Get started.

Limits that are enforced

• Allowed models — other ids return 403
• RPM / TPM — per-key; 429 when exceeded (Errors)
• Spend cap — optional cents limit on the key; org credits still apply (402)

Provider keys (BYOK)

Org-owned upstream keys (Vertex, Together, OpenAI, …) are a different object. Add them on the same API keys page or Settings → Provider Keys. The secret is encrypted and never shown again. See Bring your own keys.