Authentication

Overview

Every GoodTake API request must carry a valid API key. Keys are organization-scoped and prefixed with gt_. The same key is used by the REST API, the CLI, and the MCP server.

Base URL: https://api.goodtake.ai/v1

Getting your API key

Log in at goodtake.ai
Go to Settings → Developer Settings
Click Create New API Key
Name it (e.g. Production App) and copy it immediately — it won't be shown again

Treat API keys like passwords. Never commit them to version control. Use environment variables or a secrets manager.

Sending the key

The API accepts the key in either header — both are equivalent:

Authorization: Bearer gt_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
X-API-Key: gt_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

cURL

export GOODTAKE_API_KEY="gt_your_key_here"

curl -X POST https://api.goodtake.ai/v1/image/generate \
  -H "Authorization: Bearer $GOODTAKE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model_identifier":"gpt-image-2","prompt":"a sunset"}'

Python

import os, requests

headers = {
    "Authorization": f"Bearer {os.environ['GOODTAKE_API_KEY']}",
    "Content-Type": "application/json",
}

resp = requests.post(
    "https://api.goodtake.ai/v1/image/generate",
    headers=headers,
    json={"model_identifier": "gpt-image-2", "prompt": "a sunset"},
)
print(resp.json())

JavaScript / Node.js

const resp = await fetch("https://api.goodtake.ai/v1/image/generate", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.GOODTAKE_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ model_identifier: "gpt-image-2", prompt: "a sunset" }),
});
console.log(await resp.json());

Error responses

Status	Meaning
`401`	Missing or invalid API key
`402`	Insufficient credits
`404`	Resource not found, or owned by a different organization

Key management

Rotate keys regularly — create a new key and revoke the old one
Use separate keys per environment — development, staging, production
Monitor last-used — visible in Developer Settings; spot unexpected access early

Revoking a key

Go to Settings → Developer Settings
Find the key → click Revoke
Create a replacement immediately

Keys obtained through the CLI OAuth flow (gt auth login) or through Claude MCP are regular gt_ API keys stored in the same table — you can revoke them from Developer Settings like any other key.