Skip to main content
Inference API keys authenticate requests to your organization’s model endpoints. Keys are managed from the API keys section of the Inference API page. They belong to the active organization rather than to a single endpoint, so one active key can be used with the organization’s Inference API endpoints.

​
Create a key

  1. Open Inference API in the Compute console.
  2. In API keys, select New key.
  3. Enter a unique label using lowercase letters, numbers, and hyphens.
  4. Select Create.
  5. Copy the full key and store it securely.
  6. Select Copy and close only after you have saved it.
The full key is shown once. You won’t be able to view it again after closing the dialog. If you lose it, create a replacement key and update the application or service that uses it.
After creation, the table keeps a masked version of the key and shows its:
  • Status
  • Label
  • Masked key
  • Last used time
  • Created date

​
Use a key in a request

Send the key as a bearer token when calling an endpoint:
The endpoint details also provide generated Python, JavaScript, and curl quick-start snippets. See Call your Inference API endpoint for complete examples.

​
Disable a key

Disable a key when you want to stop requests that use it without revoking the key permanently.
  1. Open the key’s options menu.
  2. Select Disable.
  3. Confirm that you understand requests using the key will fail while it is disabled.
  4. Select Disable key.
The key remains in the table with a Disabled status and can be re-enabled later.
Disabling a key does not stop any endpoint. Running endpoints continue to incur charges.

​
Re-enable a key

To make a disabled key work again:
  1. Open its options menu.
  2. Select Re-enable.
The same stored key secret can authenticate requests again once its status returns to Active.

​
Revoke a key

Revoke a key when it should never work again, for example when you are rotating credentials or believe the key has been exposed.
  1. Open the key’s options menu.
  2. Select Revoke.
  3. Review the confirmation checklist.
  4. Confirm that dependent applications have been updated or no longer need the key.
  5. Select Permanently revoke.
After revocation:
  • Requests using that key fail permanently.
  • The action cannot be undone.
  • Running endpoints stay online and continue to incur charges.
  • You need a new key for any application that still requires access.

​
Store and rotate keys safely

  • Give each key a label that identifies its application, environment, or purpose.
  • Keep key secrets out of source code and repositories.
  • Store them in environment variables or a secrets manager.
  • Use separate keys when you want to be able to disable or revoke one application without affecting another.
  • Check Last used before removing credentials that may still be active.

​
Keys and organizations

Keys belong to the organization in which they were created. If you work with more than one Compute organization, confirm the active organization before creating a key or troubleshooting authentication. Use a key from the same organization as the endpoint you are calling.

​
Troubleshoot authentication

If a request is rejected:
  1. Confirm you copied the complete key when it was created.
  2. Check that its status is Active.
  3. Confirm the request sends Authorization: Bearer ....
  4. Confirm the key and endpoint belong to the same organization.
  5. Check that you are calling the endpoint URL shown by Inference API rather than the Compute public API.
If the key was lost, revoked, or exposed, create a new one rather than trying to recover or reuse the old secret.

​
Next steps