> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xingchaoyiqing.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GlobalAI OPC API Authentication: Keys and Best Practices

> All GlobalAI OPC endpoints require a Bearer token in the Authorization header. Learn how to set your API key securely and handle common auth errors.

Every GlobalAI OPC API endpoint — whether you're generating text, images, or videos — requires Bearer token authentication. You authenticate by including your API key in the `Authorization` header of each HTTP request. There are no cookies, sessions, or OAuth flows to manage; a single API key grants access to all endpoints your account is provisioned for.

## Your API Key

Contact the GlobalAI OPC team to obtain an API key for your account. Once issued, your key is a sensitive credential — treat it with the same care as a password.

<Warning>
  Never commit your API key to version control. If a key is accidentally exposed in a public repository, revoke it immediately and request a new one from the GlobalAI OPC team.
</Warning>

Keep the following in mind when handling your key:

* **Store it securely.** Use environment variables, a secrets manager, or an encrypted vault — never plain-text config files checked into source control.
* **Keep it private.** Do not share your key with other users or embed it in client-side code (browser JavaScript, mobile apps) where it can be extracted.
* **Rotate it if compromised.** If you suspect your key has been exposed, contact support to revoke the old key and issue a new one.

## Passing Your API Key

Include your API key in the `Authorization` header of every request, using the `Bearer` scheme. You should also set `Content-Type: application/json` for all requests that include a JSON body.

```
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json
```

### Complete Example

Here is a complete cURL request demonstrating correct header usage against the Nano Banana image generation endpoint:

```bash theme={null}
curl -X POST https://zcbservice.aizfw.cn/kyyReactApiServer/v1/banana/images \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "nano-banana-2", "prompt": "A beautiful landscape"}'
```

The same header pattern applies to all GlobalAI OPC endpoints regardless of API category:

| API Category | Example Endpoint                                                      |
| ------------ | --------------------------------------------------------------------- |
| Text         | `POST http://apillm.globalaiopc.com/gw_llm_power/v1/chat/completions` |
| Image        | `POST https://zcbservice.aizfw.cn/kyyReactApiServer/v1/banana/images` |
| Video        | `POST https://zcbservice.aizfw.cn/kyyReactApiServer/v1/sora/videos`   |

## Using Environment Variables

Store your API key in an environment variable and read it at runtime. This keeps the key out of your source code entirely.

<Tip>
  For production deployments, go beyond environment variables and use a dedicated secrets manager such as AWS Secrets Manager, Google Secret Manager, HashiCorp Vault, or your platform's built-in secrets store. These tools provide auditing, rotation, and access control on top of simple variable storage.
</Tip>

Set the variable in your shell or CI/CD environment:

```bash theme={null}
export GLOBALAIOPC_API_KEY="your_api_key_here"
```

Then read it in your application code:

```python theme={null}
import os
import requests

api_key = os.environ["GLOBALAIOPC_API_KEY"]

response = requests.post(
    "https://zcbservice.aizfw.cn/kyyReactApiServer/v1/banana/images",
    headers={
        "Authorization": f"Bearer {api_key}",
        "Content-Type": "application/json",
    },
    json={
        "model": "nano-banana-2",
        "prompt": "A beautiful landscape",
    },
)

print(response.json())
```

Using `os.environ["GLOBALAIOPC_API_KEY"]` (with square brackets) rather than `os.environ.get(...)` causes Python to raise a `KeyError` immediately if the variable is not set, which helps you catch misconfigured environments early.

## Common Auth Errors

<AccordionGroup>
  <Accordion title="401 Unauthorized — Invalid or Missing API Key">
    You receive a `401 Unauthorized` response when:

    * The `Authorization` header is missing from the request entirely.
    * The header is present but malformed (e.g. `Bearer` is misspelled, or there is extra whitespace).
    * The API key value is incorrect, has been revoked, or does not exist.

    **Fix:** Double-check that your `Authorization` header is formatted exactly as `Bearer YOUR_API_KEY` with no extra characters, and confirm the key value matches the one issued to your account.
  </Accordion>

  <Accordion title="403 Forbidden — Insufficient Endpoint Access">
    You receive a `403 Forbidden` response when:

    * Your API key is valid, but it has not been granted access to the specific endpoint you are calling.
    * Your account plan does not include the model or feature you requested.

    **Fix:** Contact the GlobalAI OPC team to verify that your key is provisioned for the endpoint and model you are trying to use.
  </Accordion>
</AccordionGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/guides/quickstart">
    Follow step-by-step examples for text, image, and video generation using your API key.
  </Card>

  <Card title="API Reference" icon="code" href="/api-reference/introduction">
    Explore every endpoint and see complete request and response schemas.
  </Card>
</CardGroup>