Gab AI API authentication: keys, Plus and rate limits
Create a key for your app, configure bearer authentication and manage its access in Settings.
API access and your account
Authenticated developer API use requires active Plus or Plus Premium and applicable credits. API usage is separate from included in-app Chat. The plans page explains current subscriptions and allowances.
Create an API key in Settings
Open Settings → API Settings and choose Create New Key. Give the key a name that identifies its app or purpose, create it and save the complete secret while it is shown. Existing masked keys cannot be recovered from their displayed prefix.
Authenticate with your complete API key
Set GAB_API_KEY in your server environment or secret store, then send the complete secret in Authorization: Bearer. Use the key exactly as issued; do not construct or add a prefix. Keep the secret out of browser bundles and repository files.
Authorization: Bearer YOUR_GAB_API_KEYcurl -sS https://gab.ai/v1/chat/completions \
-H "Authorization: Bearer $GAB_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "arya",
"messages": [
{
"role": "user",
"content": "For a workshop, income is USD 480 and base cost is USD 370. Reply with the remaining amount only, as USD 110."
}
],
"max_tokens": 1024,
"stream": false
}'Daily request limits and credits
Plus allows 10,000 requests per day and Plus Premium 50,000. The key’s daily counter resets at midnight UTC and is separate from the credit balance. Read X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset in the response. An authenticated failed request can still count toward the daily allowance.
Revoke a key you no longer need
Find the key by name in API Settings, revoke it and confirm the result. Apps using that key lose access. Remove the saved secret from those apps or replace it with the key you intend to use.
Resolve authentication and access errors
For 401, check that the complete key is set in the same environment as your app and sent in the Authorization header. For 403 plus_required, check the account’s active Plus access; insufficient_scope means the key does not permit that operation. For 402 or insufficient_credit_authorization, check credits and the requested output budget. For 429, wait until the reset time shown in the response.