Authentication

Every partner API call needs an API key, sent as a bearer token:

Authorization: Bearer gpk_...

The API has no session cookie and no CORS. A key is the only way in.

Creating a key

In the dashboard, go to Settings → API keys (/app/settings/api-keys) and select + New key. Give it a name, pick one or more scopes, then create it.

The key is shown once, immediately after creation. Copy it before you close the dialog. GPU Outlet stores only its hash, so a lost key cannot be recovered. Revoke it and create a new one.

You can hold up to 10 active keys per user. A revoked key does not count toward the 10 active keys. Its name stays taken. Never truncate a key when you log or display it.

`GET /me`

The cheapest way to confirm a key works and see what it can do. No scope is required.

curl https://api.gpuoutlet.ai/v1/me \
  -H "Authorization: Bearer gpk_..."

const res = await fetch('https://api.gpuoutlet.ai/v1/me', {
  headers: { Authorization: 'Bearer gpk_...' },
});
const key = await res.json();

Response

{
  "key_id": "3fa2c9e1-8b3e-4a1a-9c2a-4e2f6b1d9a70",
  "scopes": ["radar:read", "requests:read", "requests:write"],
  "mode": "live",
  "rate_limit_per_min": null
}

rate_limit_per_min is null unless your key has a custom limit. Otherwise the default limit applies.

Company context

A key belongs to a person, not to a company. A call acts with that person’s company and role, exactly as in the dashboard. Nothing in a request body can name a company.

If the key’s owner is not a member of any company, every company-scoped call fails with company_required.
If the owner’s role does not allow the action, the call fails with forbidden_role. A viewer can read. Stating demand, declining an opportunity or confirming readiness needs a trader, an authorized signatory or an owner.

Scopes

A key keeps the scopes it was created with. To add a scope, create a new key. A call without the required scope fails with insufficient_scope, and required_scope names the scope.

Scope	Dashboard label	Unlocks
`radar:read`	Read Radar	`GET /radar/nodes`, `GET /radar/nodes/{id}`, `GET /radar/submissions`
`radar:write`	Use Radar	`POST /radar/nodes/{id}/inquiries`, `POST /radar/submissions`, `PUT /radar/submissions/{id}`, `POST /radar/submissions/{id}/withdraw`, `POST /radar/submissions/{id}/republish`
`requests:read`	Read requests	`GET /requests`, `GET /requests/{id}`
`requests:write`	Manage requests	`POST /requests`, `PATCH /requests/{id}`, `POST /requests/{id}/close`
`opportunities:read`	Read opportunities	`GET /opportunities`, `GET /opportunities/{id}`
`opportunities:write`	Decline opportunities	`POST /opportunities/{id}/decline`
`introductions:read`	Read introductions	`GET /introductions`, `GET /introductions/{id}`
`introductions:write`	Confirm readiness	`POST /introductions/{id}/ready`

A new key starts with radar:read ticked and everything else unticked. GET /me needs no scope.

Revoking a key

Revoke a key on the same Settings → API keys page. From then on, the key answers every call with api_key_revoked. A revoked key is not deleted: it stays in the list and its name stays taken.

API quickstart

Use a key end to end: state demand, read it back.

Rate limits

Per-key, per-day and per-IP limits, and the headers that report them.

Errors

Every error code this API returns, including company_required and forbidden_role.

Idempotency

Which writes need an Idempotency-Key.

Get started

Conventions

Workflows

Endpoints

Creating a key

`GET /me`

Company context

Scopes

Revoking a key

API quickstart

Rate limits

Errors

Idempotency

​Creating a key

​GET /me

​Company context

​Scopes

​Revoking a key

​Related

API quickstart

Rate limits

Errors

Idempotency

Creating a key

`GET /me`

Company context

Scopes

Revoking a key

Related