Where do I create an API key, and do I need an overseas card?

The official route requires binding an overseas card that passes risk controls and a successful top-up before key creation — where most developers in China get stuck. An OpenAI-compatible relay with CNY top-up avoids it: sign up, verify email, small Alipay top-up, accept the terms in the console and create the key — minutes, no overseas card.

Where do I look up model codes?

Do not memorize a table; models change. Fetch the standard model-list endpoint — cocodot's is public and needs no key: curl https://cocodot.co/api/ai/v1/models — and copy the id into the model field. The console model page shows the same catalog.

The key was shown once and I did not save it — now what?

Revoke the old key in the console and create a new one; there is no recovery (by security design). Store it in a password manager at creation rather than a chat window or a stray file.

Why one key per project?

So a problem lets you revoke one key without stopping every project, and so usage can be tracked per project to find abnormal consumption. When a leak happens, the value of this habit shows immediately.

I just created a key and calls fail with a balance message — why?

These platforms generally have no free allowance; the balance must exceed 0 to call, so top up a small amount first. Prove the full pipeline (normal response, normal billing) with a tiny amount, then add as needed.

AI APIUpdated 2026-08

How to Create and Get an API Key: Step by Step for Developers in China, Plus an Error Table (2026)

Q: Why does every request return 404?

Most often base_url is missing /v1. https://cocodot.co/api/ai 404s everything; the correct value is https://cocodot.co/api/ai/v1 — the SDK appends /chat/completions. If /v1 is right but you get model not found, the model code is wrong or retired.

Step one for calling Claude / GPT is a key. Where the official route sticks, how a relay gets you one in minutes, why base_url needs /v1, and fixing 401 / 404.

TL;DR: An API key is a secret string your program presents to say 'this is who I am, bill this balance', so step one for any API call is getting a key. Developers in China rarely fail at registration on the official route; they fail at card binding — you can register, but you must bind an overseas card that passes risk controls and top up successfully before you can create a key. The way around is an OpenAI-compatible relay: create the key in its console, fund via Alipay, and the key works on the standard interface with two parameter changes in existing code. Three pitfalls to know first: ① base_url must end in `/v1` — omit it and every request 404s, the most frequent misconfiguration; ② the key is usually shown once, at creation — save it then, or revoke and recreate; ③ one key per project — not tidiness but the ability to revoke one without stopping everything.

1. What an API key is and why you need one

An API key is a secret your program sends with every request to a model service. It answers two questions: who you are, and whose balance this call bills to. It is effectively a payment credential plus an ID: whoever holds it can spend your balance. That is why the security points later are not fussiness — a leaked key means someone else spending your money, usually for a long time before you notice. It also explains the proper practice: keys live server-side and are read from environment variables, never in frontend code or a repository.

2. Where the official route sticks

To be clear: the official route is fine and the most direct — if you can complete it, it is a good choice. The obstacle for developers in China is not registration but card binding: the official console requires binding an overseas credit card that passes risk controls and a successful top-up before you can create a key. That is where it sticks — the account exists but the card is declined, or a top-up is flagged right away. A structural issuing-country problem, not a mistake on your part. So the choice is usually: solve the overseas-card step, or use a compatible relay with CNY top-up and skip card binding entirely.

3. Creating a key on a compatible relay: four steps

With cocodot it takes minutes and no overseas card: ① sign up and verify your email; ② small Alipay top-up — there is no free allowance and the balance must exceed 0 to call, so start tiny and prove the pipeline; ③ open the AI API console, accept the API terms, create an API key; ④ copy and store the key immediately — it is usually shown in full only once, disappears when the page closes, and can only be revoked and recreated if lost. Put it straight into a password manager rather than a chat window or a stray file. You now hold a credential for the standard interface; next, how to use it.

4. Using the key (and that mandatory /v1)

Such relays are OpenAI-compatible: keep the official OpenAI SDK and change two parameters — point `base_url` at the relay and put your new key in `api_key`; the `chat.completions` code stays. The most frequent misconfiguration is omitting `/v1` from base_url — `https://cocodot.co/api/ai` 404s everything; the correct value is `https://cocodot.co/api/ai/v1`. The SDK appends `/chat/completions` itself, so you supply only the `/v1` level. The same pair works in desktop clients and editor extensions with a 'custom OpenAI endpoint' field: the same base_url and key.

5. Model codes: do not memorize, query

Many guides hard-code 'code X = model Y', but models turn over and such tables go stale. The reliable approach is querying the current list — these platforms expose the OpenAI-standard model-list endpoint, and cocodot's is public, no key needed: ```bash curl https://cocodot.co/api/ai/v1/models ``` It returns a standard list; copy the `id` you want into the `model` field. Fetching the list before use beats memorizing codes and reveals retired models immediately. The console's model page shows the same catalog; if the two agree, you are fine.

6. Key security: three musts

① Never put the key in frontend code or a repository. Frontend code is public — anyone can open the browser and read it — and secrets pushed to public repositories are scraped by bots within minutes. Keep the key server-side, read it from an environment variable, and add config files to `.gitignore`. ② One key per project. Not tidiness: when something goes wrong you revoke that one key instead of stopping every project, and you can see usage per project and find who is burning money. ③ Suspect a leak? Revoke and recreate immediately — no hesitation, no 'watch it first'; recreating costs minutes, continuing costs your balance.

7. Pre-launch self-check

Once the key is wired in, before launch: ① make one small real call and confirm the response and billing are normal before scaling; ② confirm the key is not in the repository — search history with `git log -p`; a later deletion still leaves it in past commits; ③ add timeouts and retries — model calls are much slower than ordinary APIs and default timeouts often fall short; use streaming for long answers; ④ make the model code configuration, not a hard-coded string, so switching models needs no redeploy; ⑤ add usage monitoring, at least 'how much was called and spent today', so abnormal consumption is caught early rather than when the balance hits zero.

Error → likely cause → fix (work down the list, do not guess)

Error	Most likely cause	Fix
401 / Unauthorized	Wrong key, or not sent as a Bearer token	Re-copy the key; make sure it is in the api_key parameter
404 / Not Found	base_url missing /v1	Use .../api/ai/v1 — the most common one
model not found	Wrong model code or a retired model	Fetch the model list and copy a current code
Insufficient balance	Balance is 0 (no free allowance)	Top up; balance must exceed 0 to call
Constant timeouts / cannot connect	Network egress or client timeout too short	Extend the timeout; streaming suits long answers