> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nomask.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys & Authentication

> Create a NoMask API key, connect your application, and control access and spending.

Use a NoMask API key to authenticate generation, account, and usage requests. The same key works with the chat and image APIs. Browse available models in your [dashboard](https://nomask.ai/models), or send your Bearer key to the [List models endpoint](https://docs.nomask.ai/api-reference/list-models.md).

## Create an API key

**1. Open API Keys**

Sign in to NoMask and open [API Keys](https://nomask.ai/api/keys) in your developer dashboard.

**2. Create a key for your application**

Click **Create Key**, give it a recognizable name, and optionally set an expiration date and monthly USD spending limit. Your account can have up to 10 active keys.

**3. Store the key securely**

Copy the key into your server's environment variables or secret manager. You can use the copy icon in the key list to retrieve it again later.

Keys start with `nmk_live_`. Treat the full value like a password and keep it out of frontend code and source control.

## Sending the key

```http theme={"system"}
Authorization: Bearer nmk_live_...
```

Send the key in the `Authorization` header over HTTPS. Query-string keys and custom authentication headers are not supported. OpenAI SDKs set the Bearer header when you pass the key to the client.

You can verify your connection with an account request:

```bash theme={"system"}
export NOMASK_API_KEY="nmk_live_..."

curl https://api.nomask.ai/v1/me \
  -H "Authorization: Bearer $NOMASK_API_KEY"
```

The response describes the calling key and its limits. To generate your first completion, continue to the [Quickstart](https://docs.nomask.ai/quickstart.md).

## Key lifecycle

* **Create**: on the keys page. Copy the key when it is created, or use the copy icon in your key list later.
* **Edit**: name, expiration date, and monthly limit can change at any time. The key string itself never changes.
* **Expire**: a key past its expiration date stops authenticating (401) but stays listed until you delete it.
* **Delete**: immediate and permanent. The key stops working instantly. Its usage history stays in your dashboard, relabeled as "Deleted", and it no longer counts toward your 10-key limit.

## Per-key monthly limits

A monthly USD limit caps what one key can spend per calendar month. When the cap is reached, requests with that key return `429 monthly_limit_exceeded` until the month rolls over or you raise the limit. Other keys on your account are unaffected. Check a key's month-to-date spend anytime with `GET /me`.

## Security best practices

* Keep keys server-side. Never ship one in a browser bundle, mobile app, or public repo.
* Use one key per app or environment so you can delete one without breaking the others.
* Set monthly limits on keys used by experiments or third parties.
* Set expiration dates on keys handed to contractors or CI.
* If a key may have leaked, delete it immediately and create a replacement.

## Authentication errors

| Status | Code | Meaning |
| - | - | - |
| 401 | `missing_api_key` | No Authorization header, or a scheme other than Bearer. |
| 401 | `invalid_api_key` | The key does not exist or was deleted. |
| 401 | `api_key_expired` | The key is past its expiration date. |
| 401 | `api_key_revoked` | The key has been revoked. |
| 403 | `account_restricted` | The account does not have API access. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.