API keys

Your applications authenticate to the Nodea API with an API key. Keys belong to your organization: a request made with a key is served by your organization’s devices and can use your organization’s enabled models.

Create a key

Only Admins can create keys.

1. Open API keys in the console.
2. Click Create API key.
3. Enter a Name that says where the key will be used, like CI or Support bot. Names must be unique in your organization.
4. Click create, then copy the key and store it somewhere safe.

Caution

The full key is shown only once, right after you create it. If you lose it, delete the key and create a new one.

While you’re still in that browser session, the code examples on the API keys and Get started pages copy with your new key filled in.

Use a key

Send the key as a bearer token in the Authorization header:

Authorization: Bearer <your API key>

With the OpenAI SDKs, pass it as api_key (Python) or apiKey (Node). We recommend keeping it in an environment variable such as NODEA_API_KEY rather than in your code. See Making requests.

Keys stop working when their creator leaves

Each key records the Admin who created it. A key only works while its creator is an active member of the organization. If they leave, are removed, or delete their account, their keys stop working immediately. In that case:

• the API returns 401 Invalid API Key
• the API keys page marks the key Disabled, and shows Former member as its creator

Before an Admin leaves, have another Admin create replacement keys and roll them out. Then delete the old ones.

View keys

Everyone in the organization can see the list of keys. For each key it shows:

• its name
• a masked version of the key
• who created it
• when it was created

The full key is never shown again after creation.

Delete a key

Admins can delete a key with the trash icon next to it. Anything using the key stops working immediately, and this can’t be undone. Deleting is also how you revoke a key that may have leaked.

Good practice

• One key per application or environment. Then you can replace one without touching the others.
• Treat keys like passwords. Don’t commit them to source control or put them in client-side code such as browser apps or mobile apps.
• Replace keys when an Admin leaves, before their account is removed.

Keys don’t expire, and there’s currently no per-key usage view or rate limit. Usage for the whole organization is on the Models and Fleet pages.