Build

API keys

An API key authenticates your backend to UsageGate. It scopes every check, consume, grant, and rules call to your workspace. Never ship a key in a browser bundle.

Create a key

1. Open API keys.
2. Generate a key. Copy the full value once — plaintext is shown only at creation.
3. Store it as USAGEGATE_KEY in your server env (and set USAGEGATE_API_BASE_URL to your UsageGate host).

USAGEGATE_KEY=gk_...
USAGEGATE_API_BASE_URL=http://127.0.0.1:43123

Use it

import { GateClient } from "@usagegate0/sdk";

const gate = new GateClient(process.env.USAGEGATE_KEY!, {
  baseUrl: process.env.USAGEGATE_API_BASE_URL,
});

HTTP clients send Authorization: Bearer <api_key> on /api/v1/* routes. Details: HTTP API.

Revoke

From the keys dashboard, revoke a compromised or unused key. Revoked keys are rejected immediately on the next request. Rotate by creating a new key, updating your env, then revoking the old one.

What a key is not

• Not an end-user session — Maya never gets a UsageGate key
• Not a Stripe secret — keep whsec_… on the Stripe page
• Not scoped per feature — one workspace key covers all feature keys