Authentication

The Developer API uses API keys issued by KitchenGPT. Keys are shown once at creation time and are never recoverable — rotate by issuing a new key and revoking the old one.

API key header

Send your key on every request using either header:

Authorization: Bearer kgpt_...

# or

X-Api-Key: kgpt_...

Example

curl "https://kitchengpt.io/v1/me" \
  -H "Authorization: Bearer kgpt_YOUR_KEY" \
  -H "Accept: application/json"

Scopes & modules

Each client has an allow-list of modules. Keys may further restrict scopes. Calling a module that is not enabled returns 403 module_not_allowed.

Quotas

Per-minute rate limit — configurable per client (default 60). Exceeding it returns 429 rate_limited with a Retry-After header.
Monthly request quota — configurable per client. Exceeding it returns 429 quota_exceeded.
Monthly credit allowance — each job consumes credits based on the module (configurable in admin). Exceeding it returns 429 credits_exceeded.

Inspect remaining quota and credits via GET /v1/me.

Security

Store keys in a secrets manager — never in client-side JavaScript.
Prefer server-to-server calls.
Rotate keys if they may have been exposed.
Suspended clients receive 403 forbidden.