API keys

An API key lets you call the PortModels API as yourself — from a script, a notebook, or a server you control. It is not the mechanism apps use to act on behalf of other people; that is Connect.

Creating a key#

apikey.create returns a new key beginning with pm_:

pm_Zx3l0...

The full key is shown once, at creation. It is stored only as a hash, so nobody — including PortModels support — can retrieve it later. Copy it immediately into wherever it needs to live.

apikey.list shows your keys by preview (pm_Zx3..._Qk1) and creation date, so you can tell them apart without revealing them.

Using a key#

curl https://api.portmodels.com/openai/v1/chat/completions \
  -H "Authorization: Bearer pm_..." \
  -H "Content-Type: application/json" \
  -d '{"model": "portmodels/gpt-oss", "messages": [{"role": "user", "content": "Hello"}]}'

See Authentication for how pm_ keys differ from pmc_ Connect tokens.

Spending#

Calls made with your key spend your credits. There is no separate budget and no per-key limit, so a runaway loop in a script draws down the same balance you use everywhere else. Watch your usage log when you first automate something.

Keeping keys safe#

• Never put a key in client-side code. Anything shipped to a browser or a downloadable app is readable. Keys belong on a server you control.
• Never commit a key. Use an environment variable and add your env file to .gitignore.
• One key per purpose. Separate keys for separate scripts mean you can revoke one without breaking the rest.
• Rotate on suspicion, not on proof. Revoking and reissuing costs a minute; an exposed key costs credits.

Revoking#

apikey.revoke takes a key_id and disables it immediately. Requests using it start failing with 401 right away.

If you think a key leaked: revoke it first, then check your usage log for calls you did not make, then issue a replacement.