API keys

Create API keys

1. Log in to your innoGPT account

2. Go to Settings → API Keys

3. Click on Create API Key

4. Enter a meaningful name (e.g., "Backend-Prod," "CI-Pipeline")

5. Set a monthly limit (see below — important!)

6. Optional: Configure the IP allowlist

7. Copy the key immediately — it will only be displayed once

Use the API key

In every request in the Authorization header:

Authorization: Bearer sk_live_************************ 

Example:

curl -X POST \ -H "Authorization: Bearer sk_live_dein_key" \ -H "Content-Type: application/json" \ https://app.innogpt.de/api/ext/v1/chat/completions \ -d '{ "model": "gpt-5", "messages": [{"role": "user", "content": "Hallo!"}] }' 

⚠️ Important: Always set a limit for your API key

When creating a new API key, be sure to define a monthly usage limit. This protects you from:

• Accidental overuse — e.g., if a script gets stuck in an infinite loop

• Misuse if the key is compromised — in case your key ends up in a public repo

• Uncontrolled costs due to premium models in long sessions

Here’s how to set the limit:

• When creating → Fill in the "Monthly Limit" field

• Later → Settings → API Keys → 3-dot menu → Edit Limit

Note: Currently, you must contact innoGPT support to increase your API limit.

Security Best Practices

Keep keys secret

• ❌ Never commit API keys to Git

• ✅ Use environment variables (.env file in .gitignore)

• ✅ Rotate keys regularly (recommended every 90 days)

• ✅ Use separate keys for development and production

Key rotation

Via the API endpoint:

curl -X POST \ -H "Authorization: Bearer $OLD_KEY" \ https://app.innogpt.de/api/ext/v1/api-keys/rotate 

Or in the account: Settings → API Keys → 3-dot menu → Rotate Key.

IP allowlists

For added security: Restrict API key usage to specific IP addresses.

1. Go to Settings → API Keys

2. Select the key → Edit

3. Add allowed IP addresses or CIDR ranges

4. Save

Requests from unauthorized IPs will be rejected with a 403 Forbidden error.

Rate Limits

Each API key has configurable limits:

Limits are specified in the response headers:

X-RateLimit-Limit: 100 X-RateLimit-Remaining: 95 X-RateLimit-Reset: 1699999999 

Error responses

Invalid API key (401)

{ "error": { "message": "Invalid API key provided", "type": "authentication_error", "code": "invalid_api_key" } } 

Missing API key (401)

{ "error": { "message": "No API key provided", "type": "authentication_error", "code": "missing_api_key" } } 

IP not allowed (403)

{ "error": { "message": "Request IP not in allowlist", "type": "authentication_error", "code": "ip_not_allowed" } } 

Team API access

API keys are team-specific. Requirements:

• ✅ Active subscription with API access

• ✅ At least one API key created

• ✅ Sufficient budget (if limits are set)

Contact your workspace admin if you don’t have access yet.