Authentication

Geek Hub uses API keys with the ghub_sk_ prefix sent in the Authorization: Bearer header.

Key format

Type	Prefix	Use
Production	`ghub_sk_live_`	Real calls, consume balance
Sandbox (coming soon)	`ghub_sk_test_`	Testing without balance

Each key is 45 characters total. The ghub_sk_live_ prefix (13 chars) + 32 random chars.

If you lose the key, we cannot recover it. You have to revoke the current one and generate a new one.

Pass it in the Authorization header:

curl https://api.geekhub.mx/v1/models \
  -H "Authorization: Bearer ghub_sk_live_xxxxx"

Or with SDKs:

from openai import OpenAI

client = OpenAI(
    base_url="https://api.geekhub.mx/v1",
    api_key="ghub_sk_live_xxxxx",  # ideally from env var
)

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://api.geekhub.mx/v1",
  apiKey: process.env.GEEKHUB_API_KEY,
});

Don't hardcode keys in code

Use environment variables (process.env.GEEKHUB_API_KEY) or secrets services (AWS Secrets Manager, Vault, etc).

One key per environment / app

Create separate keys for production, staging, CI, etc. If one is compromised, you only revoke that one.

Revoke unused keys

In the dashboard, unused keys appear marked. Revoke them to reduce attack surface.

Rotate periodically

Every 90 days: generate new, deploy, revoke the old one.

HTTP code	Message	Cause
`401`	`missing_api_key`	You didn’t send the `Authorization` header
`401`	`invalid_api_key`	Key doesn’t exist or is revoked
`402`	`insufficient_balance`	Your balance is ≤ $0 MXN, top up

See Errors for the full catalog.