> ## Documentation Index
> Fetch the complete documentation index at: https://apione.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create and protect API keys

> Create credentials, separate applications, and rotate keys safely.

An APIONE API Key authorizes inference requests; it is not your console password. Send it in request headers from your server and keep it out of browser code, screenshots, and logs.

![APIONE API Key settings, connection addresses, and pricing groups.](https://mintcdn.com/apione/pAFvFGkbmcRZirTZ/images/ui/api-keys-overview.png?fit=max\&auto=format\&n=pAFvFGkbmcRZirTZ\&q=85\&s=286a882ab53c81ad3bd16d56c6487dc9)

APIONE API Key settings, connection addresses, and pricing groups.

## Create and save a key

1. Sign in to the [APIONE console](https://apione.ai/en/app).
2. Open [API Keys](https://apione.ai/en/app/api-keys) and create a key for your application.
3. Set the available model permissions, billing group, and expiration options shown in the console. Save the complete key when it is displayed.
4. Send a minimal [quickstart request](https://apione.ai/docs/en/quickstart.md) to verify access.

## Groups and permissions

The selected group determines available models and their prices. After creating or editing a key, query `GET /v1/models` before making application requests. See [model discovery](https://apione.ai/docs/en/models/catalog.md) and [group pricing](https://apione.ai/docs/en/account/usage.md).

## Authentication

OpenAI-compatible requests use `Authorization: Bearer YOUR_APIONE_KEY`. Anthropic-compatible requests can use x-api-key. Use one authentication method per request.

## Recommended practices

* Separate development, testing, and production keys to simplify usage tracking and rotation.
* Store credentials in environment variables or a server-side secret manager, not frontend code or public configuration.
* Log aliases or redacted identifiers instead of full keys and headers.
* If a key is exposed, disable or revoke it in the console, configure a replacement, and verify recovery using available management controls.

## Rotation checklist

Check health requests, model permissions, and error rates after deployment. Confirm all instances have switched before retiring the old key. If rotation fails, provide request IDs and redacted configuration to support rather than credentials.

Related: [Usage and costs](https://apione.ai/docs/en/account/usage.md), [Contact support](https://apione.ai/docs/en/support/contact.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.