The directory's access desk approves it automatically, usually within about ten minutes, and the key arrives by email from the directory. Check the spam folder if it is not there in twenty.

Drew, the directory's operator, reads it and answers within a day. A short reply asking what your agent will do with the directory is not a refusal; it is the question the form asked.

It looks like gtmd_ followed by 32 characters. Put it in an Authorization: Bearer header, or use the per-key URL if your client only takes a URL. Both forms are shown on the request page, with the fallback host for clients that hit a Cloudflare 403 on the apex.

The hosted copy records, per key, the number of calls and the date last used, and nothing else. To revoke the key, reply to the email it came in.