---
title: "Authenticate with the GPT-Video API"
description: "Create an API key in the GPT-Video app, choose its scopes and send it as a Bearer token. How to keep a key safe and what to do if it leaks."
url: "https://www.gpt-video.com/developers/authentication"
---

# Authentication

Every request to the GPT-Video API sends an API key. The key says which account the call works on and what it may do. This page covers how to create a key, how to send it and what the errors about keys mean.

## Create a key

1. Sign in to GPT-Video. If you do not have an account yet, create one and confirm your email address.
2. Open Developers in the GPT-Video app, at `https://www.gpt-video.com/app/developers`.
3. Create a key and choose its scopes.
4. Copy the key. It is shown once, because GPT-Video stores only a hash of it. If you lose it, revoke it and create another one.

A key starts with `gvk_` and has 47 characters. Each key also has an id that starts with `mck_`, which `get_me` (`GET /v1/me`) returns. The id names the key and does not work as a key.

**Expires after** sets a date when the key stops working. Leave it on **Never** for a server or an agent that should keep running.

## Scopes

A key has one or more scopes. Each endpoint needs at least one of them, and its page in the [API reference](/developers/api.md) names it.

| Scope | What it allows |
| --- | --- |
| `clips:read` | Reads projects, clips, jobs, exports and the balance. |
| `clips:write` | Changes things, such as uploads, projects and clips. |
| `spend` | Uses credits or the daily export allowance, such as analyses and exports. |

Give each key only the scopes it needs. A key for a dashboard that shows results needs only `clips:read`.

## Send the key

Send the key in the `Authorization` header of every request, as `Bearer` followed by the key. The examples on these pages read the key from the environment variable `GPT_VIDEO_API_KEY`.

[`get_me`](/developers/api/get-me.md) (`GET /v1/me`). Check a key before using it.

```bash title="curl"
curl "https://api.gpt-video.com/v1/me" \
  -H "Authorization: Bearer $GPT_VIDEO_API_KEY"
```

```ts title="TypeScript"
const res = await fetch("https://api.gpt-video.com/v1/me", {
  method: "GET",
  headers: {
    "Authorization": `Bearer ${process.env.GPT_VIDEO_API_KEY}`,
  },
});
const data = await res.json();
console.log(data);
```

```python title="Python"
import os

import requests

r = requests.get(
    "https://api.gpt-video.com/v1/me",
    headers={
        "Authorization": f"Bearer {os.environ['GPT_VIDEO_API_KEY']}",
    },
)
data = r.json()
print(data)
```

```json title="MCP (Full)"
{
  "method": "tools/call",
  "params": {
    "name": "get_me",
    "arguments": {}
  }
}
```

**Example response**

`GET /v1/me`

```json title="HTTP 200"
{
  "key": {
    "id": "mck_5f2c9e1a7b3d8046",
    "scopes": [
      "clips:read",
      "clips:write",
      "spend"
    ]
  },
  "account": {
    "plan": "creator"
  }
}
```

`get_me` (`GET /v1/me`) uses no credits. Call it first to check that the key works and to read `key.scopes` before you upload or spend anything.

A key works on the account that created it. Every call acts on that account, so no endpoint takes an account id.

## Keep the key safe

Anyone who has the key can use the account through the API, and with the `spend` scope they can use its credits.

- Keep the key on your server or in an environment variable. Do not put it in code that runs in a browser or in an app you give to other people.
- Do not commit it to a repository or paste it into a chat.
- If a key may have leaked, revoke it on the Developers page and create a new one. A revoked key stops working.

You may use the API inside a product you offer to others. You are responsible for what your users do with your key, and every call counts against your account.

The box on these pages where you can paste a key keeps it in the browser tab only. These pages never send it anywhere.

## Errors about keys

| Code | Status | What it means | What to do |
| --- | --- | --- | --- |
| `UNAUTHORIZED` | 401 | The key is missing, wrong or revoked, or the account cannot use the API yet. | Check the `Authorization` header. Create a new key if this one was revoked or expired. |
| `SCOPE_MISSING` | 403 | The key does not have the scope the endpoint needs. | Create a key with the scope named in the error, or use a key that has it. |

Sending the same request again gives the same answer, so fix the key first. [Errors](/developers/errors.md) has every other code.

## Rate limits

Each key has its own rate limit, and the account has one for all its keys together. A second key does not raise the limit of the account. [Rate limits and daily limits](/developers/rate-limits.md) gives the numbers and the headers that report them.