API keys provide service-to-service authentication through the
X-Api-Key header without a user JWT. A key belongs to one service, carries
granular permissions, can expire, tracks use, and is revealed only when created.
Endpoint and task index
| Goal | Page |
|---|---|
| Create, list, inspect, or delete keys; look up models and permissions | Endpoint reference |
| Authenticate a service or copy a Node.js/Python integration | Usage and integration recipes |
| Define storage, rotation, expiry, monitoring, and compromise controls | Security and operations |
| Diagnose rejected, expired, under-permissioned, or rate-limited keys | Troubleshooting |
Appropriate uses
- Backend subscription checks
- Internal administration tools
- Service analytics collectors
- Automated user provisioning
- Time-limited CI/CD integrations
API keys are credentials, not configuration values. Never commit or log the plaintext value. Grant only the permissions needed by one workload and environment.