> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inferoute.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate with Inferoute

> Inferoute authenticates requests with API keys passed as Bearer tokens. Learn how to generate a key, pass it in requests, and follow security best practices.

Inferoute authenticates every request using an API key passed as a Bearer token in the `Authorization` header. You generate API keys in the Inferoute dashboard and can create multiple keys for different environments, teams, or applications.

## Generate an API key

1. Sign in to your Inferoute dashboard at [inferoute.ai](https://inferoute.ai).
2. Go to **Settings → API Keys**.
3. Click **New API key**.
4. Enter a descriptive name for the key (for example, `production-app` or `dev-local`).
5. Optionally set an expiry date to limit how long the key remains valid.
6. Click **Create** and copy the key immediately — it will not be shown again.

<Warning>
  Copy your API key before closing the dialog. Inferoute stores only a hashed version of the key and cannot display it again after creation. If you lose a key, revoke it and create a new one.
</Warning>

## Pass the API key in requests

Include your API key in the `Authorization` header of every request using the `Bearer` scheme.

<CodeGroup>
  ```python python theme={null}
  import os
  from openai import OpenAI

  client = OpenAI(
      base_url="https://api.inferoute.ai/v1",
      api_key=os.environ["INFEROUTE_API_KEY"],
  )

  response = client.chat.completions.create(
      model="gpt-4o-mini",
      messages=[{"role": "user", "content": "Hello"}],
  )
  ```

  ```javascript node.js theme={null}
  import OpenAI from "openai";

  const client = new OpenAI({
    baseURL: "https://api.inferoute.ai/v1",
    apiKey: process.env.INFEROUTE_API_KEY,
  });

  const response = await client.chat.completions.create({
    model: "gpt-4o-mini",
    messages: [{ role: "user", content: "Hello" }],
  });
  ```

  ```bash curl theme={null}
  curl https://api.inferoute.ai/v1/chat/completions \
    -H "Authorization: Bearer $INFEROUTE_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{
      "model": "gpt-4o-mini",
      "messages": [{ "role": "user", "content": "Hello" }]
    }'
  ```
</CodeGroup>

## Use environment variables

Store your API key in an environment variable rather than hardcoding it in your application. The recommended variable name is `INFEROUTE_API_KEY`.

```bash theme={null}
export INFEROUTE_API_KEY="your_api_key_here"
```

For long-running applications, set the variable in your deployment environment (for example, in a `.env` file loaded by your framework, or through your cloud provider's secrets manager).

## Invalid and expired keys

If you provide a missing, malformed, or expired API key, Inferoute returns a `401 Unauthorized` response:

```json theme={null}
{
  "error": {
    "message": "Invalid API key provided.",
    "type": "authentication_error",
    "code": "invalid_api_key"
  }
}
```

Check the following if you receive a `401` error:

* The `Authorization` header is present and uses the `Bearer` prefix.
* The key was copied correctly with no leading or trailing whitespace.
* The key has not expired (check **Settings → API Keys** in the dashboard).
* The key has not been revoked.

## Security best practices

* **Use environment variables** — never hardcode an API key in source code or configuration files.
* **Never commit keys to version control** — add `.env` and any secrets files to your `.gitignore`.
* **Create separate keys per environment** — use distinct keys for development, staging, and production so you can revoke one without affecting the others.
* **Set expiry dates** — use short-lived keys for CI pipelines and temporary integrations.
* **Rotate keys regularly** — revoke and replace keys periodically, especially after a team member leaves or a potential exposure.
* **Limit key scope** — if your use case allows, create keys with restricted permissions rather than full-access keys.

<Tip>
  You can create as many API keys as you need. Using one key per application or service makes it easy to audit usage and revoke access for a single integration without disrupting others.
</Tip>

## Manage your API keys

You can view, rename, and revoke API keys at any time from **Settings → API Keys** in the dashboard. For more on setting per-key rate limits and token budgets, see [API key configuration](/docs/configuration/api-keys).