Skip to main content
Every request carries an API key in the Authorization header. Keys are created in API → API Keys. A key belongs to your account, generates as you, and spends your Gems. Keys work once the account has a successful payment (any Gem pack or plan); before that, every call answers 402 payment_required.

Create a key

  1. Sign in to Mage and open API → API Keys. You can also choose API (Beta), below Agent in the navigation, then select API Keys.
  2. Select Create API key, enter a Key name in the popup, and select Create key. Use a name for the service or environment that will use it, such as Production server.
  3. In You’re ready to build, select Copy key and store it securely before closing the popup. An editable quick start and playground appear below the key.
A key starts with mage_sk_ and is shown only once. Mage stores only a hash of it, so a lost key cannot be recovered: create a new one and revoke the old one.

Authorization header

Manage keys

API → API Keys has two tabs:
  • Active lists keys that can authenticate requests. An account may hold up to 10 active keys. To revoke one, select Revoke beside it and confirm in the popup.
  • Revoked lists keys that no longer work, including their revocation dates and usage history. Revoked keys do not count toward the active-key limit.
Both tabs show when each key was last used, how many requests it made, and its Gems usage over the last 30 days. API → Stats shows usage across active and revoked keys. Only accepted requests count; a refused one costs nothing. Revocation takes effect immediately. Generations already running finish, but the key can no longer submit, read, or cancel requests.
Keep keys on your servers. The API sends no CORS headers, so a browser cannot call it directly, and a key shipped inside an app can be extracted and used to spend your Gems. Store keys in a secrets manager or environment variables, never in source control, logs, or URLs, and rotate a key as soon as you suspect it leaked.

Authentication errors

A request without a usable key is refused with 401 unauthorized and the error envelope.
A valid key on an account that cannot generate, for example a banned one, is refused with 403 forbidden when it submits.
Last modified on October 26, 2026