Authentication
API keys, where to make them, how to rotate and revoke them.
Every request carries a Getuser API key:
Authorization: Bearer gu_7Hk2pQ...x-api-key: gu_… works too, for tools that only send that. Never put a key in a URL.
Keys
- Made in Settings › Connect to AI › For developers › New key, with a name you choose.
gu_plus 40 random characters. Shown once; Getuser keeps only a hash of it and its first 10 characters ("gu_7Hk2pQ…") so you can tell keys apart.- One key = one workspace. It acts as the founder who made it, with the same credits and limits.
- Up to 10 live keys per workspace.
- There is no test key: every call that renders spends real credits. Use
POST /videos/plan(free) while you build.
Rotate
Make a new key, switch your code to it, then revoke the old one. Both work in between.
Revoke
Settings › Connect to AI lists every key with when it was last used. Revoke stops it at once: the next call answers 401 invalid_key.
Claude and ChatGPT connections are keys too (made when the founder clicks Allow). Disconnecting one revokes its key.
When a key leaks
Revoke it straight away, then make a new one. If you cannot sign in, email support@getuser.app and we revoke it for you. Keys start with gu_ so GitHub's secret scanning and log scrubbers can spot them.
When a key is refused
| Code | Why |
|---|---|
invalid_key (401) | Missing, mistyped or revoked. |
terms_not_accepted (403) | The Terms changed. The founder opens getuser.app once and accepts them. |
suspended (403) | The account is paused. |