WormGPT API

The WormGPT API is OpenAI-compatible. Any client that speaks the OpenAI/v1/chat/completionsprotocol works — just change the base URL and API key.

• Base URL: https://worm-gpt.com/v1
• Auth: Authorization: Bearer wg_live_…
• Content-Type: application/json
• Streaming: Server-Sent Events (SSE) with OpenAI-format chunks and a [DONE] terminator.

All requests must include your key in the Authorization header:

Authorization: Bearer wg_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Create and manage keys on the Developer page. Keys are shown once at creation — WormGPT stores only a hash. Revoke a key anytime; new requests will fail with 401 revoked_api_key.

Verify your key:

curl https://worm-gpt.com/v1/models \
  -H "Authorization: Bearer $WORMGPT_API_KEY"

Generate a model reply from a list of messages. Returns a JSON completion, or an SSE stream when stream: true.

Request body

Example request

curl https://worm-gpt.com/v1/chat/completions \
  -H "Authorization: Bearer $WORMGPT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "wormgpt-flash",
    "messages": [
      {"role": "system", "content": "You are a helpful assistant."},
      {"role": "user", "content": "Explain HTTPS in one sentence."}
    ]
  }'

Example response

{
  "id": "chatcmpl-d6481db091ba4f5fab9897a0",
  "object": "chat.completion",
  "created": 1783120047,
  "model": "wormgpt-flash",
  "choices": [
    {
      "index": 0,
      "message": { "role": "assistant", "content": "HTTPS encrypts data in transit between your browser and a server." },
      "finish_reason": "stop"
    }
  ],
  "usage": { "prompt_tokens": 18, "completion_tokens": 14, "total_tokens": 32 }
}

Set stream: true in the body. The response is text/event-stream: one JSON payload per data: line, terminated by data: [DONE]. The final chunk carries finish_reason and a usage object.

Streaming request

curl -N https://worm-gpt.com/v1/chat/completions \
  -H "Authorization: Bearer $WORMGPT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "wormgpt-flash",
    "stream": true,
    "messages": [{"role": "user", "content": "Write a haiku about firewalls."}]
  }'

Streaming response

data: {"id":"chatcmpl-...","object":"chat.completion.chunk","created":1783120061,"model":"wormgpt-flash","choices":[{"index":0,"delta":{"role":"assistant"},"finish_reason":null}]}

data: {"id":"chatcmpl-...","object":"chat.completion.chunk","created":1783120061,"model":"wormgpt-flash","choices":[{"index":0,"delta":{"content":"Firewalls "},"finish_reason":null}]}

data: {"id":"chatcmpl-...","object":"chat.completion.chunk","created":1783120061,"model":"wormgpt-flash","choices":[{"index":0,"delta":{"content":"stand guard..."},"finish_reason":null}]}

data: {"id":"chatcmpl-...","object":"chat.completion.chunk","created":1783120061,"model":"wormgpt-flash","choices":[{"index":0,"delta":{},"finish_reason":"stop"}],"usage":{"prompt_tokens":9,"completion_tokens":22,"total_tokens":31}}

data: [DONE]

List available models.

Example response

{
  "object": "list",
  "data": [
    { "id": "wormgpt-flash", "object": "model", "created": 1700000000, "owned_by": "wormgpt", "description": "Fast general-purpose model." },
    { "id": "wormgpt-pro",   "object": "model", "created": 1700000000, "owned_by": "wormgpt", "description": "Higher-quality reasoning model." }
  ]
}

Every response includes standard rate-limit headers so you can back off gracefully. Limits are enforced per API key, and monthly quotas are shared across all keys on your account.

Response headers

When you exceed a limit, the API returns 429 rate_limit_error with code: rpm (per-minute) or code: monthly. Use exponential backoff with jitter.

Errors return JSON in this shape:

{
  "error": {
    "message": "Invalid API key.",
    "type": "invalid_request_error",
    "code": "invalid_api_key",
    "param": null
  }
}

• Keys are stored as SHA-256 hashes. Once created, the plaintext is never retrievable — save it immediately.
• Rotate keys regularly and revoke any key that may have been exposed.
• All requests must use HTTPS. Plaintext HTTP is rejected.
• Never call the API directly from a browser or mobile app with a production key. Proxy through your server.
• Scope keys per environment (e.g. prod-backend, staging) so you can revoke one without disrupting others.