> For the complete documentation index, see [llms.txt](https://docs.nebulablock.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nebulablock.com/account/api-keys.md).

# API Keys

Create, reveal, disable, and delete Nebula Block API keys, including team keys, and keep them secure.

An API key authenticates your requests to both the [Inference API](/api-reference/inference-api.md) and the [Platform API](/api-reference/platform-api.md). Keys are long-lived — unlike access tokens, they do not expire — which makes them the right credential for applications, servers, and CI.

## Managing keys in the console

Go to [**API Keys**](https://console.nebulablock.com/apiKeys) in the console. From there you can:

* **Create a key.** Give it a name — names must be unique within your account — and an optional description. The key value can be revealed and copied from the key list at any time, so losing it is not a reason to rotate; suspecting it leaked is.
* **Disable a key.** Disabling stops the key authenticating immediately, and it can be re-enabled later. Use this rather than deleting when you only need to cut access temporarily.
* **Delete a key.** Permanent, and anything still using it starts failing with `401`.

An account can hold up to **20** API keys at once. If you need more, contact support.

> **Note:** Keys cannot be regenerated in place. To rotate one, create a replacement, move your applications over, and then delete the old key.

## Using a key

Send it as a Bearer token:

```
Authorization: Bearer sk-...
```

```bash
curl https://inference.nebulablock.com/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $NEBULA_API_KEY" \
  -d '{"model": "deepseek-ai/DeepSeek-V3.2", "messages": [{"role": "user", "content": "Hello"}]}'
```

All Nebula Block API keys are prefixed with `sk-`.

## Team keys

A key can belong to a [team](/account/teams.md) instead of to you personally. Team keys draw on the team's resources and are visible to the team's members, which is what you want for shared services rather than personal experiments. Create one by selecting the team when you create the key, or by passing `team_id` to [Create API Key](/api-reference/platform-api/list-api-keys/create-api-key.md).

## Keeping keys safe

* Keep keys out of source control and out of client-side code. Load them from environment variables or a secrets manager.
* Give each application its own key, so you can revoke one without disrupting the others.
* If a key may have leaked, disable it immediately, then create a replacement and delete the old one.
* Usage and spend are attributed per key, so separate keys also make it easier to see where cost comes from.

## Managing keys through the API

|                                                                               |                     |
| ----------------------------------------------------------------------------- | ------------------- |
| [List API Keys](/api-reference/platform-api/list-api-keys.md)                 | `GET /keys`         |
| [Create API Key](/api-reference/platform-api/list-api-keys/create-api-key.md) | `POST /keys`        |
| [Update API Key](/api-reference/platform-api/list-api-keys/update-api-key.md) | `PUT /keys/{id}`    |
| [Delete API Key](/api-reference/platform-api/list-api-keys/delete-api-key.md) | `DELETE /keys/{id}` |

## See also

* [Authentication](/api-reference/authentication.md)
* [Teams](/account/teams.md)
* [Glossary](/resources/glossary.md)