> ## Documentation Index
> Fetch the complete documentation index at: https://docs.noimosai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate requests

> Understand Developer Platform API keys, permissions, expiration, and secure key management.

## Overview

This page covers authentication with Developer Platform API keys, permissions, expiration, and secure storage. Each key is bound to one project and can perform only the operations its permissions allow.

## Use a Developer Platform API key

Send this Authorization header with every request.

```http theme={null}
Authorization: Bearer nmp_...
```

Keys issued in regular NoimosAI team settings use workspaces, their permissions, and NoimosAI credits. Developer Platform keys use separate projects, permissions, and prepaid USD balances.

| Key | Used for | Main data | Billing |
| - | - | - | - |
| `nmp_` | Developer Platform API | Developer projects, API executions and artifacts | Prepaid USD balance |
| Regular NoimosAI API key | CLI, Local MCP, regular tool API | NoimosAI workspace | NoimosAI credits |

> [!WARNING]
>
> The two key types are not interchangeable. An invalid key, insufficient permissions, or insufficient balance never triggers an automatic switch to another authentication method or billing account.

## Set required permissions

Select the permissions your use case needs when creating a key.

| Permission | Allowed operations |
| - | - |
| `project:read` | Read the key's organization and project |
| `usage:read` | Read settled usage and USD charges for the current month |
| `tools:read` | Retrieve the tool catalog and request free quotes |
| `tools:execute` | Upload inputs, execute paid work, and cancel executions |
| `executions:read` | Retrieve execution status, results, and artifact download URLs |

Separate keys used only for connection checks from keys that execute paid work to limit accidental execution. For a typical paid flow, check all permissions needed for project lookup, quoting, execution, and results.

## Who can create keys

Project `ADMIN` and `DEVELOPER` members can create keys. Organization administrators also need explicit membership in the target project to access it.

Keys are subject to their creator's and project's permissions. A key stops working if its creator's account is disabled, its creator is removed from the project, or the key is revoked.

## Manage expiration

Choose the expiration in the Developer Platform key creation screen, and check it in the key list after creation. The full key is shown only once; save it securely before closing the screen.

Before expiration, create a new key, switch your integrations to it, and revoke the old key. Revoke immediately if you suspect a leak.

## Store keys securely

Treat API keys as server-side secrets that are never distributed to users' browsers.

* Store them in environment variables or a secret manager.
* Do not write them to Git, logs, error screens, or analytics events.
* Do not embed them in browser or mobile apps.
* Use separate keys and projects for production, staging, and development.
* Create keys per use case and grant only necessary permissions.

## Troubleshoot authentication

Check the HTTP status and key state when authentication fails.

* `401` — Check the Authorization header, full key, expiration, and revocation.
* `403` — Check required permissions and the key owner's project access.
* `429` — Check request limits, prepaid balance, and organization or project monthly caps.

If you are unsure whether a key matches the endpoint, call `GET /tools/project` before submitting paid work.

## Related pages

See these pages for key creation and common specifications.

* [Get started](https://docs.noimosai.com/developers/api/getting-started.md)
* [API reference](https://docs.noimosai.com/developers/api/reference.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.