Skip to main content
Use a NoMask API key to authenticate generation, account, and usage requests. The same key works with the chat and image APIs. Browse available models in your dashboard, or send your Bearer key to the List models endpoint.

​
Create an API key

1

Open API Keys

Sign in to NoMask and open API Keys in your developer dashboard.
2

Create a key for your application

Click Create Key, give it a recognizable name, and optionally set an expiration date and monthly USD spending limit. Your account can have up to 10 active keys.
3

Store the key securely

Copy the key into your server’s environment variables or secret manager. You can use the copy icon in the key list to retrieve it again later.
Keys start with nmk_live_. Treat the full value like a password and keep it out of frontend code and source control.

​
Sending the key

Send the key in the Authorization header over HTTPS. Query-string keys and custom authentication headers are not supported. OpenAI SDKs set the Bearer header when you pass the key to the client. You can verify your connection with an account request:
The response describes the calling key and its limits. To generate your first completion, continue to the Quickstart.

​
Key lifecycle

  • Create: on the keys page. Copy the key when it is created, or use the copy icon in your key list later.
  • Edit: name, expiration date, and monthly limit can change at any time. The key string itself never changes.
  • Expire: a key past its expiration date stops authenticating (401) but stays listed until you delete it.
  • Delete: immediate and permanent. The key stops working instantly. Its usage history stays in your dashboard, relabeled as “Deleted”, and it no longer counts toward your 10-key limit.

​
Per-key monthly limits

A monthly USD limit caps what one key can spend per calendar month. When the cap is reached, requests with that key return 429 monthly_limit_exceeded until the month rolls over or you raise the limit. Other keys on your account are unaffected. Check a key’s month-to-date spend anytime with GET /me.

​
Security best practices

  • Keep keys server-side. Never ship one in a browser bundle, mobile app, or public repo.
  • Use one key per app or environment so you can delete one without breaking the others.
  • Set monthly limits on keys used by experiments or third parties.
  • Set expiration dates on keys handed to contractors or CI.
  • If a key may have leaked, delete it immediately and create a replacement.

​
Authentication errors