Skip to main content

​
Overview

This page covers authentication with Developer Platform API keys, permissions, expiration, and secure storage. Each key is bound to one project and can perform only the operations its permissions allow.

​
Use a Developer Platform API key

Send this Authorization header with every request.
Keys issued in regular NoimosAI team settings use workspaces, their permissions, and NoimosAI credits. Developer Platform keys use separate projects, permissions, and prepaid USD balances.
The two key types are not interchangeable. An invalid key, insufficient permissions, or insufficient balance never triggers an automatic switch to another authentication method or billing account.

​
Set required permissions

Select the permissions your use case needs when creating a key. Separate keys used only for connection checks from keys that execute paid work to limit accidental execution. For a typical paid flow, check all permissions needed for project lookup, quoting, execution, and results.

​
Who can create keys

Project ADMIN and DEVELOPER members can create keys. Organization administrators also need explicit membership in the target project to access it. Keys are subject to their creator’s and project’s permissions. A key stops working if its creator’s account is disabled, its creator is removed from the project, or the key is revoked.

​
Manage expiration

Choose the expiration in the Developer Platform key creation screen, and check it in the key list after creation. The full key is shown only once; save it securely before closing the screen. Before expiration, create a new key, switch your integrations to it, and revoke the old key. Revoke immediately if you suspect a leak.

​
Store keys securely

Treat API keys as server-side secrets that are never distributed to users’ browsers.
  • Store them in environment variables or a secret manager.
  • Do not write them to Git, logs, error screens, or analytics events.
  • Do not embed them in browser or mobile apps.
  • Use separate keys and projects for production, staging, and development.
  • Create keys per use case and grant only necessary permissions.

​
Troubleshoot authentication

Check the HTTP status and key state when authentication fails.
  • 401 — Check the Authorization header, full key, expiration, and revocation.
  • 403 — Check required permissions and the key owner’s project access.
  • 429 — Check request limits, prepaid balance, and organization or project monthly caps.
If you are unsure whether a key matches the endpoint, call GET /tools/project before submitting paid work. See these pages for key creation and common specifications.