Skip to main content
Every request to Horizon (REST or MCP) is authenticated with a single Bearer API key.

​
Key format

Keys are 32 random bytes, hex-encoded, prefixed with gk_live_. There is currently only one environment (no separate gk_test_ keys) — every key is a live key that spends real credits.

​
Sending the key

Requests with a missing or malformed Authorization header get a 401 with error: "unauthorized". See Errors & Rate Limits for the full error shape.

​
Getting a key

Keys are issued automatically, no waiting on a human required. Two ways to get one:
  • Sign up at lite.gravitygtm.com — create an account, pick a plan (free trial or a paid pack) through Stripe Checkout, and your dashboard shows your key under Keys (shown once, right there — save it immediately, since it’s not emailed and the page won’t show it again). From the same dashboard you can also connect Slack whenever you want conversational access alongside the API — see Add Horizon to Slack.
  • Call POST /api/stripe/checkout directly with { "pack": "free" } (a $0, card-on-file free trial) or a paid pack id (pack_49 / pack_199 / pack_499 — see Credits & Pricing). The response is a normal Stripe Checkout URL; completing it shows your key and starting credit balance once, right on the Checkout success page in your browser — save it immediately, since the page will not show it again and it is not sent by email. If you miss it, sign in to the dashboard above (a one-time “link an existing key” step connects it to an account) or contact support.
Either path issues the same kind of key — a Slack-connected account’s key works against the REST API and MCP server exactly like any other, and vice versa, since Slack, REST, and MCP all draw from one shared credit balance. New keys are issued with 1,000 free trial credits.

​
Rotating a key

Keys can be rotated without downtime: a new key is issued while the old one keeps working for a 24-hour grace period, so in-flight integrations have time to switch over before the old key stops authenticating. Ask your Horizon contact to rotate a key for you; there’s no self-service rotation endpoint yet. A key can also be revoked immediately and permanently if it’s compromised — mention this when you reach out if that’s the situation.

​
Storage and display

Only a SHA-256 hash of your key is ever stored — the plaintext key is shown to you exactly once, at issuance. Keep it somewhere safe (a secrets manager, not a repo) since it can’t be retrieved again, only rotated.