Get an API key

Create one

1. Sign in and open the console › API Keys.
2. Click “New key” and name it after its purpose and environment, e.g. web-prod.
3. Optionally choose the allowed models, pricing tier and expiry, then save.
4. Copy the full key — it is not shown again after the dialog closes; if lost, rotate it or create a new one.

Key format

A key is a random string that carries no account data. The list shows only its prefix and last four characters so you can tell keys apart. It stops working the moment it is disabled, deleted or expires — there is no cache to wait out.

What you can restrict

Storing it

• Read it from an environment variable or secret manager on the server; the frontend should call your own backend.
• Use a different key per environment (dev / staging / prod) so one incident revokes one key.
• Inject it from repository secrets in CI; never commit .env.

# Local development: keep it in the shell, not in code
export APIONE_API_KEY="YOUR_APIONE_KEY"

# Verify it works (200 means valid)
curl -s -o /dev/null -w "%{http_code}\n" \
  https://api.apione.ai/v1/models \
  -H "Authorization: Bearer $APIONE_API_KEY"

Rotation and revocation

Rotate roughly every 90 days. The safe order is: create the new key → roll services over gradually → confirm usage has moved → delete the old key. Deletion is immediate and irreversible; to pause a key temporarily, disable it instead.

Related

• API key management — organising keys across teams and environments.
• Reference › Authentication — headers and error responses.