API keys
An API key authenticates every call you make to aixplain from the SDK, the REST API or the OpenAI-compatible endpoint.
Keys belong to one workspace and use that workspace's assets and credits. Each workspace holds up to 10 keys. Manage them in the aixplain app at Settings > API keys.
Create a key
- Open Settings > API keys in the workspace the key should use.
- Click Create API key.
- Enter a name that says where the key runs, for example
Production web app. - Optionally set an expiration date. Leave it empty for a key that does not expire.
- Click Create, then copy the key. The full key is shown only once.
If you lose a key, delete it and create a new one. The key list shows each key's name, creator, dates, status and last characters.
Use a key in the SDK
from aixplain import Aixplain
aix = Aixplain(api_key="YOUR_API_KEY")
agent = aix.Agent(
name="Support agent",
description="Answers customer questions.",
instructions="Be concise and helpful.",
).save()
result = agent.run("Say hello in five words.")
print(result.data.output)
In production, read the key from an environment variable: Aixplain(api_key=os.environ["AIXPLAIN_API_KEY"]).
Use a key with the REST API
Send the key in the x-api-key header. The call returns a URL to poll for the result; see REST API.
curl -X POST "https://platform-api.aixplain.com/v2/agents/YOUR_AGENT_ID/run" \
-H "x-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "Say hello in five words."}'
Use a key with the OpenAI-compatible endpoint
LLMs on aixplain also answer the OpenAI chat completions format. Point the OpenAI client at https://models.aixplain.com/api/v1 and pass an asset path as the model.
from openai import OpenAI
client = OpenAI(api_key="YOUR_API_KEY", base_url="https://models.aixplain.com/api/v1")
completion = client.chat.completions.create(
model="openai/gpt-4o-mini/openai",
messages=[{"role": "user", "content": "Say hello in one short sentence."}],
)
print(completion.choices[0].message.content)
Admin keys and limits
Owners and Admins can create admin keys. An admin key does not run models or agents; it sets request, token and credit limits on the workspace's other keys. See Rate limiting.
Keep keys safe
- Store keys in environment variables or a secrets manager, never in version control.
- Never put a key in client-side code such as browser JavaScript.
- Use one key per application, so you can revoke one without breaking the others.
- Rotate keys on a schedule, and delete keys for retired applications.
Deleting a key revokes it at once and cannot be undone; applications that still use it get authentication errors. In a team workspace, Owners and Admins can delete any key.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
Invalid API key | The key was deleted, expired, mistyped or belongs to another workspace. | Check that the key is active in the right workspace and copied in full. |
| HTTP 429, 497 or 498 | A rate limit or credit limit on the key was reached. | Back off and retry, or ask an Admin to raise the key's limits. |
err.not_enough_balance | The workspace has no credits. | Add credits; see Credits and billing. |
Forbidden on aix.APIKey.search() | The key is not an admin key. | Use an admin key to list or change keys. |
Next steps
- Rate limiting: cap requests, tokens and credits per key.
- Credits and billing: fund the workspace your keys draw from.
- REST API: call agents and models over HTTP.