Skip to main content

Authentication

Every request uses your own PopGo API key.

Get a key​

Sign in and create or select a Key on the keys page. Use it only in a local client or server environment you trust. Open the API keys page.

How to create a Key​

  • Use a recognizable name, such as local development, one device, or one client, so you can audit and disable it later.
  • Groups, quota limits, expiry, and access restrictions follow the options currently shown in the portal. Keep defaults first if unsure, then tighten them after the request works.
  • Copy the Key immediately after creation and store it safely. If the full Key is no longer visible, disable the old one and create a replacement.

Send credentials​

OpenAI compatible uses Authorization: Bearer; Gemini native requests prefer x-goog-api-key and also accept Bearer; Claude Messages prefers x-api-key and also accepts Bearer. Do not put a Key in URL query parameters unless a client explicitly requires it.

Authorization: Bearer YOUR_API_KEY
x-api-key: YOUR_API_KEY
x-goog-api-key: YOUR_API_KEY

Protect the key​

  • Never place a key in public code, screenshots, or issue reports.
  • Use a separate Key for each device or application so it can be disabled independently.
  • If authentication fails, copy the Key again instead of passing it through a browser address.

Where to use it​

  • Local clients: paste it into the API Key field, never into public screenshots or chat logs.
  • Server projects: use environment variables or your deployment secret manager, not committed files.
  • Team use: split Keys by member, device, or purpose so one Key can be disabled without disrupting everything.

Verify authentication​

Run the quickstart request first. A normal JSON response confirms authentication; for a 401, inspect the header, Key status, and surrounding whitespace.