How to Get an AI API Key: 5 Vendors, 5 Different Processes

You copy the generated string from your dashboard, paste it into your code, and get 401 authentication_error back. Getting an API key for an AI model is no longer a one-click job. Vendors keep making authorization more involved: they tie access to service accounts, impose hard key lifetimes and make you exchange secrets for temporary tokens. What used to be just a password now requires understanding how access works on each specific platform.

In short

There is no single standard any more. If you need to plug in an AI model quickly, you'll have to deal with each provider's rules separately.

1. Google is changing the rules. In September 2026, old Standard Gemini keys stop working. Moving to keys tied to a service account is mandatory.
2. A key can live for just hours. Anthropic lets you issue keys that expire in as little as 3 hours, and once they expire they can't be extended.
3. Sber has no static keys at all. GigaChat issues a pair of secrets that you have to exchange for an access token every 30 minutes.
4. A free key doesn't mean free requests. OpenAI and DeepSeek create keys instantly, but token billing starts almost right away.
5. Aggregation solves part of the problem. One key covers OpenAI, Google and Anthropic, but for GigaChat you still have to go to the vendor directly.

Google: tied to a service account, with a migration deadline

For a long time, Gemini keys were simple strings. They were bound to a Google Cloud project purely for billing and quotas, and they didn't identify the caller.

The official documentation (checked on September 10, 2026) announces a major change. In September 2026, the Gemini API will start rejecting requests made with old Standard keys. The documentation doesn't name the exact day within the month. The vendor asks you to finish migrating to the new Authorization keys before then to avoid service interruptions.

The difference between the two formats is architectural. New Authorization keys are bound directly to a Google Cloud service account, so every request you make is processed on behalf of that service account. That gives the vendor fine-grained access control - and gives the developer one more entity to manage.

The free tier rules have changed too. Pro models were dropped from free access back in April 2026; only Flash and Flash-Lite models remain. Meanwhile, the rate-limits page doesn't publish specific limit numbers. Google says plainly that limits depend on many factors and tells you to check yours individually in Google AI Studio. Any exact free-tier numbers you find on third-party blogs aren't backed by the current documentation.

Anthropic: keys with an expiry date and workspace headers

Anthropic is moving in the same direction, away from anonymous strings, but does it through key lifetimes. When you create a key in the developer console, you have to choose its type: a personal key that acts on behalf of a person, or a service account key that acts on behalf of a service. The old workspace key format is now marked as legacy.

The most important change is the key lifetime. It's set strictly at creation, with presets of 3 hours, 1 day, 7 days, 30 days, a custom duration or Never. The documentation (as of September 10, 2026) stresses that the expiration time is set once and can't be changed later. As soon as the time runs out, the API starts returning 401 authentication_error. You can't extend such a key - you have to issue a new one.

There's one more restriction. If the key isn't strictly bound to a workspace, every request must carry the anthropic-workspace-id header. Without it, the server returns 400 invalid_request_error and refuses to process the prompt.

GigaChat: exchanging secrets for a 30-minute token

GigaChat's architecture has no concept of a permanent API key for model requests at all. Authorization is split into steps.

In the Studio dashboard, a user with the "Owner" or "Administrator" role clicks "Get key". At that moment the system issues three values: Authorization Key, Client ID and Client Secret. The Authorization Key is a Base64-encoded string built from the other two values. The Authorization Key and the Client Secret are shown only once and aren't stored in the dashboard.

To send a request to the model, the developer has to make a POST request to a dedicated authorization endpoint, passing those secrets. The response contains an access token, which lives exactly 30 minutes. All subsequent model requests are signed with this temporary token, and the exchange has to be repeated programmatically every half hour.

OpenAI and DeepSeek: instant keys, paid tokens

At OpenAI and DeepSeek the procedure looks traditional. A key is created in the dashboard in a couple of clicks and stays valid until you revoke it.

OpenAI's documentation keeps the process as simple as possible: create a key, put it in an environment variable and make a test request. The platform even congratulates you with "Congrats on running a free test API request!" and then suggests moving to higher limits. But there's no direct information on how many requests you can make before you have to top up. In practice, the only free part is generating the key string; the tokens cost money.

DeepSeek is similar. The documentation tells you to apply for an API key and use the current models. Reviews online often claim that DeepSeek gives new accounts 5 million free tokens. As of September 10, 2026, that figure isn't confirmed anywhere in the vendor's official documentation. The terms may have changed, so check your remaining balance in the dashboard after signing up rather than trusting reviews.

How many secrets you store before the first request

Because the vendors take such different approaches, developers end up managing completely different sets of secrets and tracking their lifecycles. The summary is current as of September 10, 2026.

Unified access: the economics and the limits

Instead of supporting different authentication procedures, tracking expiring Anthropic keys and refreshing GigaChat's 30-minute tokens, you can use a single OpenAI-compatible key. Our service gives you access to OpenAI, Google, Anthropic and xAI models through one endpoint.

A caveat up front: GigaChat isn't in the altrouter catalog. DeepSeek is (DeepSeek V4.1 Flash and V4 Pro as of October 27, 2026). If your project is hard-wired to GigaChat, you'll have to get a key directly from the vendor using the procedure above.

Besides unified authorization, we offer a discount off the vendor's official price. Below is the monthly cost difference for a small team's workload (an assistant in the editor plus a few scripts). The assumption: 10M input tokens and 2M output tokens. The Central Bank of Russia rate on the day the data was taken (September 10, 2026) was 85.4594 ₽ per dollar.

Let's be honest about the economics. At hobby volumes (say, 300K input tokens and 60K output), the difference comes to 3 to 21 ₽ a month. At that scale, a discount off the vendor's official price isn't an argument. The real argument is not having to go through key issuance separately with every vendor: you keep one account and don't rewrite your authorization logic for each one.

Where to start

1. Sign up for altrouter and issue a key in your dashboard. You don't need to exchange it for a temporary token every half hour - see authentication.
2. Top up your balance. Billing is per token, with no hidden subscriptions.
3. In your code that uses the standard SDKs, point base_url at the altrouter endpoint and use the key you got.
4. Switch models by changing the model parameter in the request body, without touching the authorization logic.

The full list of available models, their current versions and token prices is in the model catalog.

FAQ