Send your API key in the Authorization header of every request. A browser sign-in session does not replace an API key.
Each key can have an expiry date, model limits, IP limits and a spend limit that you set on the API keys page.
Key points
- Required header: Authorization: Bearer YOUR_API_KEY.
- Revoked, disabled, expired or IP-restricted keys are rejected (401/403).
- You can view a key again on the API keys page; keep it as secret as a password.
- Rotating a key creates a new one and disables the old one immediately.