Every request to the public API carries an API key, sent as a bearer token. Keys belong to an account.
Make and manage keys on the dashboard, with a free IsraelGPT account. Name a key after what it's for and it's ready at once. There's no application to fill in for the free tier; for higher limits there is the Pro API, by application.
An account can have up to 5 keys at a time (more with a Pro plan). Revoke one to make room for another. Keys from before IsraelGPT was rebuilt no longer work: make a new one.
Every request, on the native and the OpenAI-compatible endpoints alike, needs an Authorization header (OpenAI SDKs and tools send it for you from their API key setting):
Authorization: Bearer igpt_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx401 missing_api_key.401 invalid_api_key.429). Guessing a key is hopeless anyway; this also stops a program that keeps retrying a revoked key.403 suspended, with the reason and how to appeal.Browsers can call the API directly: it answers CORS from any origin, so a page can use fetch with the Authorization header. Its rate-limit headers (X-RateLimit-*, Retry-After) are readable from the page too.
Putting your key in a web page is a vulnerability. Anyone who opens the page can copy the key from its source or DevTools and use your allowance from anywhere, and their calls count against your account. The only fix is to revoke the key. If you can, call the API from a server you run and have your page talk to that server, so the key never leaves it.
Keys are igpt_ followed by 43 random characters. IsraelGPT keeps only a keyed hash of each key, plus its last four characters so you can tell your keys apart. The key itself is shown once, when it's made. If you lose it, there's no getting it back: revoke it and make a new one.
Each key has a Media switch on the dashboard, on by default. It affects the native endpoint only (the OpenAI-compatible one never returns media). Turn it off for an integration that only handles text: the model is told not to use [attachment?...] tags (pictures, GIFs, songs, podcasts), any that slip through are taken out of reply, and there's no media. The change applies to the next request.
Open a key on the dashboard to see what it's been used for, newest first, for the last 30 days:
| Column | What it shows |
|---|---|
| When | The time of the request. |
| Result | The HTTP status, and what happened: answered, blocked, crisis resources, bad request, over the limit, or the model failed. |
| Model | The model and persona asked for. |
| Tokens | Tokens in and out, as the model counted them. |
| Took | How long the answer took. |
| App | What the caller said it is, from its User-Agent: a library like Python (httpx), a tool like curl, or your own name like MyApp/1.0. Any program can claim to be anything, so it's a label, not proof. |
| From | The network the request came from, as Cloudflare saw it, the country, and whether it's a data center (a server) or a home or mobile network. The address itself is never kept or shown. |
What was said is never in the log. Refusals for going over a limit show at most once a minute, so a runaway loop can't flood it. If calls come from a network or app you don't recognise, the key has leaked: revoke it.
| Do | Don't |
|---|---|
| Keep it on your server (an environment variable or a secrets manager) | Don't put it in a web page, a browser extension or an app people download: that's a vulnerability, anyone can copy it |
| Use one key per app or bot | Don't share one key between unrelated projects |
| Revoke a key the moment you think it leaked | Don't commit a key to a git repository |
| Check the request log now and then | Don't ignore calls from networks you don't recognise |
Anyone with your key uses your allowance, and what they send is tied to your account. Revoking on the dashboard stops a key on its very next request.
There's no guest tier: a key always belongs to a real account, so every key can use every persona, High effort and both models. Every key on an account follows the account's plan: the free limits, or the limits of an approved Pro API application (see Rate Limits). A suspended account's keys stop working.