Skip to main content
Every request needs a key. Send it in the X-API-Key header:
Tools that can’t set headers can pass the key as the api_key query parameter instead. Prefer the header where you can: URLs end up in logs and browser history. The MCP server takes the key as Authorization: Bearer sk_live_... (or X-API-Key). See AI agents (MCP).

​
Managing keys

Create, rename, rotate and revoke keys in the dashboard.
  • Keys start with sk_live_ and are shown once, when you create or rotate them.
  • An account can have up to 10 active keys. All of them share the account’s credits and rate limit.
  • Rotating a key issues a new one and stops the old one at once. Revoking stops it at once.
  • You need a verified email to create a key.
  • We email a security notice when a key is created, rotated or revoked. You can turn this off in notifications.
Keep keys on your server. Don’t put them in browser code or mobile apps, where anyone can read them.
A missing, unknown or revoked key returns 401 invalid_api_key.
Last modified on October 23, 2026