Authentication

All GLM 5 API requests require an API key. Create and manage keys from API Keys.

Send a bearer token

Add the key to the Authorization header:

Authorization: Bearer sk-glm5-...

curl https://glm5.app/api/v1/models \
  -H "Authorization: Bearer $GLM5_API_KEY"

API keys begin with sk-glm5-. The plaintext value is shown only when the key is created; GLM 5 stores a hash rather than the recoverable key.

Store keys safely

Use an environment variable or your deployment platform's secret manager:

GLM5_API_KEY=sk-glm5-your-key

import OpenAI from 'openai';

const client = new OpenAI({
  apiKey: process.env.GLM5_API_KEY,
  baseURL: 'https://glm5.app/api/v1',
});

Use separate keys

Create a different key for each environment or application:

• local-development
• staging
• production
• background-worker

Separate keys make rotation and usage diagnosis safer. Deleting or disabling one key does not require replacing every integration.

Authentication errors

A missing, malformed, disabled, deleted, or unknown key returns:

{
  "error": {
    "message": "Invalid API key provided.",
    "type": "invalid_request_error",
    "code": "invalid_api_key",
    "param": null
  }
}

The HTTP status is 401. See Errors for the complete error reference.