AI API Keys: When a Website Can Use Domain Authorization

What does an AI API key do?

An AI API key is a credential used by a service to recognize and authorize an application making requests. Its exact permissions depend on the provider. A key might identify an account, connect requests to billing or grant access to particular services. It does not make an AI model understand your business automatically.

When a provider treats its API key as secret, placing that key in browser JavaScript exposes it to people who load the page. Minifying the file or hiding the value in a frontend configuration variable does not turn it into a secret. Follow that provider's supported architecture for protecting credentials.

Gammal Tech uses a different authorization approach for its website SDK. Developers register approved website domains rather than obtaining an AI API key to paste into the browser.

Distinguish a key from a project ID and a session

These terms describe different parts of an integration. Treating them as interchangeable can lead to incorrect setup instructions or false security assumptions.

A project ID alone does not replace the domain and authentication requirements. Equally, registering a domain does not grant your website access to a user's identity documents or contact details.

When is domain authorization a suitable option?

This approach fits a website that needs to request ready-made AI responses through the Gammal Tech SDK. Examples include explaining product specifications you supply, helping visitors compare service packages or answering questions from a prepared set of business facts.

The supported platform is a website, not a native mobile application. A responsive website opened on a phone is still a website, but that does not establish support for native SDKs or mobile app integrations.

If your requirement is specifically an OpenAI API key, an OpenAI model or compatibility with an existing OpenAI client, verify that requirement separately. Gammal Tech's AI service should not be described as supplying an OpenAI key merely because people search for “free ChatGPT API” or “free AI API key.”

Prepare the account, project and domains

Current registration documents: Use the National ID of a country whose citizenship you hold, not a residence-only ID. An Egyptian passport is accepted only for an Egyptian living abroad without their Egyptian National ID available. An Egyptian birth certificate is accepted only for an Egyptian living in Egypt, under 15, who has neither a National ID nor a passport. Check the official registration requirements before applying.

1. Use your existing Gammal Tech account. Each person registers once for life. If you do not have an account, apply at Gammal Tech Join. Approval can take up to ten days.
2. Use documents from your country of citizenship. An Egyptian citizen living in Saudi Arabia applies with an Egyptian National ID; an Egyptian passport is accepted only if the Egyptian applicant lives abroad and does not have that National ID available, not a residence-country ID.
3. Create the website project after approval. Sign in at My Gammal Tech, open the console, enable developer mode and create a project.
4. Register the HTTPS domains. A project supports up to four domains. The bare domain and its www version are separate entries.

Write down where people will actually use the website. A redirect from one hostname to another can change the domain that needs authorization. If you use a separate staging site, plan its domain registration before testing there.

Understand what the free allowance covers

The first project is free, with 200 free signed-in AI calls per project each month. The allowance resets monthly. Each request to the AI counts as a call; a conversation with several exchanges is not necessarily one call, and the allowance is not a count of unique visitors.

Signed-in calls above the allowance cost 0.20 EGP each under the documented pricing. Additional projects have a one-time fee. Read the AI API pricing guide before choosing a usage budget.

In particular, a developer with an approved account must still implement the visitor login flow. Approval of the website owner's account does not satisfy the signed-in requirement for every person visiting the site.

Check the integration before publishing

• Open the actual HTTPS address and compare its hostname with the project's registered domains.
• Check both bare-domain and www behavior if visitors can reach both.
• Test a signed-out visit, an intentional login and a signed-in AI request.
• Show a useful message when a request cannot complete. Do not replace a failed AI response with invented information.
• Keep passwords, secret credentials and confidential operational information out of browser-visible prompts.
• Use business facts you control. Domain authorization does not automatically connect the assistant to stock, orders or payments.

For a systematic review of answers and failure states, use the website AI testing checklist. Authorization solves only part of the integration; the visitor still needs clear answers and understandable feedback.

Questions about AI API keys

Where do I get a free AI API key for Gammal Tech?

This website integration does not issue an AI API key for you to embed. Set up the approved account, project and registered domains, then follow the documented SDK and visitor authentication flow.

Does a public project ID expose users' national IDs?

No. Partner developers cannot retrieve national IDs, identity documents, phone numbers or email addresses held by Gammal Tech. Your website can retrieve information it previously saved itself, such as a visitor's selected interface language.

Can I use a registered website domain for a native mobile app?

The documented feature is for websites. Registering a domain does not turn the browser SDK into a native mobile API. Confirm your deployment platform before designing the integration.