Get startedAuthentication

Authentication

The GPUs.io API authenticates with a bearer token. Subscribe to get a key, then send it in the Authorization header on every request.

Getting a key

Subscribe on the API access page. Checkout and billing are handled by Polar, our payments provider. The moment your payment is confirmed we email your key to you— keep it somewhere safe, as it's shown only once. Lost it? You can issue a fresh one anytime from the key management page.

Plan prices exclude any applicable taxes, which are calculated at checkout. By subscribing you agree to our Terms of Service and Privacy Policy.

Using your key

Send your key as a bearer token in the Authorization header on every request:

curl -G https://api.gpus.io/v1/prices \
  -H "Authorization: Bearer $GPUS_API_KEY"

Keep your key secret. Your key grants access to the API. Never commit it to source control or expose it in client-side code — call the API from your backend and inject the key from an environment variable such as GPUS_API_KEY. Keys are opaque secrets; treat the whole string as sensitive.

Managing your key & billing

Go to the key management page and sign in with a one-time code we email to the address your key was sent to. From there you can rotatea key — issue a fresh one and immediately retire the old one. Rotating is the fix if a key leaks or is lost: your old key stops working and you get a new one in the same step, so you're never left without a working key.

Everything billing-related — updating your card, downloading invoices, or cancelling — lives in the Polar customer portal, which you can open straight from the management page. Cancelling your subscription revokes your key, and your daily quota resets at the start of each day.

Authentication errors

A missing or malformed Authorization header returns 401 with an UNAUTHORIZED error and a WWW-Authenticate response header:

401 Unauthorized

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing or malformed Authorization header. Use: Authorization: Bearer <api-key>"
  }
}

An unknown or revoked key also returns 401, with the message Invalid API key. There is no separate status for an inactive key — any key the server can't accept is a 401.

Main site Access Support