Developer API

API keys and authentication

Create, scope, store, rotate, and revoke Developer API keys safely.

On this pageCreate a named key Choose the smallest permission Keep the key server-side Limit and rotate

Create a named key

Open the Developer console and create a key for one environment or service. Keys begin with opmd_sk_ and are shown only once, so copy them directly into an approved secret manager.

APIKeysUsageBillingSettingsDocs● LIVE

API Keys

Manage keys for the Oppermind Lato 1 unified gateway — text, image and video in one API

Create New API KeyKeys prefix opmd_sk_ — store securely, shown only onceKey Name

Production server

Permissions

Full Access (text + image + video) ▾

Rate Limit Override

Default (plan limit) ▾

Generate API Key

Your API KeysRefresh

Production server● Activefull

opmd_sk_live_9f2a••••••••••••••••••••

Created 12 Aug 2026Used 2 minutes ago18,204 requests

Staging● Activetext

opmd_sk_stg_41c7••••••••••••••••••••

Created 20 Aug 2026Used yesterday312 requests

Old CI key○ Revokedread

opmd_sk_ci_08be••••••••••••••••••••

Created 3 Jun 2026Never used0 requests

Name the key for the system that will hold it; the full key is shown once.

Try this

✦Open the Developer console from Settings, Developer API, Open developer console. Under Create New API Key enter the name orders-service-prod, choose Text Only, and click Generate API Key.

What you getThe new key beginning opmd_sk_ is displayed once; you paste it straight into your secret manager, because afterwards the console shows only the key's name and status.

Choose the smallest permission

Available key permissions include full access, text only, image generation, and read only. Video generation requires full permission. Do not give a service capabilities it never calls.

APIKeysUsageBillingSettingsDocs● LIVE

API Keys

Manage keys for the Oppermind Lato 1 unified gateway — text, image and video in one API

Create New API KeyKeys prefix opmd_sk_ — store securely, shown only onceKey Name

Content pipeline

Permissions

Text Only ▾

Rate Limit Override

Default (plan limit) ▾

Generate API Key

Your API KeysRefresh

Production server● Activefull

opmd_sk_live_9f2a••••••••••••••••••••

Created 12 Aug 2026Used 2 minutes ago18,204 requests

Staging● Activetext

opmd_sk_stg_41c7••••••••••••••••••••

Created 20 Aug 2026Used yesterday312 requests

Old CI key○ Revokedread

opmd_sk_ci_08be••••••••••••••••••••

Created 3 Jun 2026Never used0 requests

Pick the smallest permission the integration needs.

Try this

✦From a test script, call POST /api/v1/images with a Text Only key: {"prompt": "flat-lay photo of our new stationery range"}

What you getThe call is refused with 403 and error.code OPMD_AUTH_002 because the key lacks image permission; an Image Generation key succeeds, and video needs Full Access.

Keep the key server-side

Store the key in a backend secret or environment variable. Your application should authenticate its own users, authorize the requested action, and call Oppermind from the server.

POST/api/v1/messages200 OK

Request

# runs inside your POST /api/summarise handler, after the session check
curl https://oppermind.com/api/v1/messages \
  -H "Authorization: Bearer $OPPERMIND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"oppermind-lato-1","max_tokens":300,"messages":[{"role":"user","content":"Summarise this in three sentences: <validated text from the request>"}]}'

Response

X-Request-ID: req_5b2d8f1a3c7e9b4d6a0f2c8eX-API-Version: 2026-06-17

{
  "id": "req_5b2d8f1a3c7e9b4d6a0f2c8e",
  "model": "oppermind-lato-1",
  "role": "assistant",
  "content": [
    {
      "type": "text",
      "text": "The proposal moves invoicing to a monthly cycle from October. Existing customers keep their current terms until renewal. Finance owns the migration plan."
    }
  ],
  "stop_reason": "end_turn",
  "usage": {
    "input_tokens": 148,
    "output_tokens": 33
  }
}

Only your server sends this request; the browser never sees $OPPERMIND_API_KEY.

Try this

✦Add a route in your own backend, for example POST /api/summarise, that checks the caller's session, validates the input, then calls https://oppermind.com/api/v1/messages with the key read from process.env.OPPERMIND_API_KEY.

What you getThe browser only ever talks to your route; the opmd_sk_ key never appears in network requests from the page, so a leaked front-end bundle exposes nothing.

Limit and rotate

Use separate keys for development, staging, and production. Apply per-key rate controls and an IP allowlist where appropriate. Revoke a leaked or retired key immediately.

POST/api/v1/messages403 Forbidden

Request

# app-prod key, sent from an address outside its IP allowlist
curl https://oppermind.com/api/v1/messages \
  -H "Authorization: Bearer $OPPERMIND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"oppermind-lato-1","messages":[{"role":"user","content":"Hello"}]}'

Response

X-API-Version: 2026-06-17

{
  "error": {
    "type": "authentication_error",
    "code": "OPMD_AUTH_003",
    "message": "IP not in developer allowlist"
  }
}

Outside the allowlist the prod key is refused with OPMD_AUTH_003; a revoked key returns 401 instead.

Try this

✦Create separate keys named app-dev, app-staging and app-prod, add only your production egress range to the IP allowlist in the console, and when a key leaks open its entry and click Delete Key.

What you getCalls from an address outside the allowlist return 403 with error.code OPMD_AUTH_003; the deleted key's entry shows Revoked and every request using it is refused immediately.

◎

GUIDED LEARNING

Practise this in Oppermind Academy

Follow the related tutorial or course and apply the concept to a real task.

Open learning path