GlobalAI OPC API Authentication: Keys and Best Practices

All GlobalAI OPC endpoints require a Bearer token in the Authorization header. Learn how to set your API key securely and handle common auth errors.

Every GlobalAI OPC API endpoint — whether you’re generating text, images, or videos — requires Bearer token authentication. You authenticate by including your API key in the Authorization header of each HTTP request. There are no cookies, sessions, or OAuth flows to manage; a single API key grants access to all endpoints your account is provisioned for.

Your API Key

Contact the GlobalAI OPC team to obtain an API key for your account. Once issued, your key is a sensitive credential — treat it with the same care as a password.

Never commit your API key to version control. If a key is accidentally exposed in a public repository, revoke it immediately and request a new one from the GlobalAI OPC team.

Keep the following in mind when handling your key:

• Store it securely. Use environment variables, a secrets manager, or an encrypted vault — never plain-text config files checked into source control.
• Keep it private. Do not share your key with other users or embed it in client-side code (browser JavaScript, mobile apps) where it can be extracted.
• Rotate it if compromised. If you suspect your key has been exposed, contact support to revoke the old key and issue a new one.

Passing Your API Key

Include your API key in the Authorization header of every request, using the Bearer scheme. You should also set Content-Type: application/json for all requests that include a JSON body.

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

Complete Example

Here is a complete cURL request demonstrating correct header usage against the Nano Banana image generation endpoint:

curl -X POST https://zcbservice.aizfw.cn/kyyReactApiServer/v1/banana/images \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "nano-banana-2", "prompt": "A beautiful landscape"}'

The same header pattern applies to all GlobalAI OPC endpoints regardless of API category:

API Category	Example Endpoint
Text	POST http://apillm.globalaiopc.com/gw_llm_power/v1/chat/completions
Image	POST https://zcbservice.aizfw.cn/kyyReactApiServer/v1/banana/images
Video	POST https://zcbservice.aizfw.cn/kyyReactApiServer/v1/sora/videos

Using Environment Variables

Store your API key in an environment variable and read it at runtime. This keeps the key out of your source code entirely.

For production deployments, go beyond environment variables and use a dedicated secrets manager such as AWS Secrets Manager, Google Secret Manager, HashiCorp Vault, or your platform’s built-in secrets store. These tools provide auditing, rotation, and access control on top of simple variable storage.

Set the variable in your shell or CI/CD environment:

export GLOBALAIOPC_API_KEY="your_api_key_here"

Then read it in your application code:

import os
import requests

api_key = os.environ["GLOBALAIOPC_API_KEY"]

response = requests.post(
    "https://zcbservice.aizfw.cn/kyyReactApiServer/v1/banana/images",
    headers={
        "Authorization": f"Bearer {api_key}",
        "Content-Type": "application/json",
    },
    json={
        "model": "nano-banana-2",
        "prompt": "A beautiful landscape",
    },
)

print(response.json())

Using os.environ["GLOBALAIOPC_API_KEY"] (with square brackets) rather than os.environ.get(...) causes Python to raise a KeyError immediately if the variable is not set, which helps you catch misconfigured environments early.

Common Auth Errors

401 Unauthorized — Invalid or Missing API Key

You receive a 401 Unauthorized response when:

• The Authorization header is missing from the request entirely.
• The header is present but malformed (e.g. Bearer is misspelled, or there is extra whitespace).
• The API key value is incorrect, has been revoked, or does not exist.

Fix: Double-check that your Authorization header is formatted exactly as Bearer YOUR_API_KEY with no extra characters, and confirm the key value matches the one issued to your account.

403 Forbidden — Insufficient Endpoint Access

You receive a 403 Forbidden response when:

• Your API key is valid, but it has not been granted access to the specific endpoint you are calling.
• Your account plan does not include the model or feature you requested.

Fix: Contact the GlobalAI OPC team to verify that your key is provisioned for the endpoint and model you are trying to use.

Next Steps

Quickstart

Follow step-by-step examples for text, image, and video generation using your API key.

API Reference

Explore every endpoint and see complete request and response schemas.