> ## Documentation Index
> Fetch the complete documentation index at: https://docs.novita.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

An API key authenticates requests to Novita AI. This page explains how to create and store a key, use it across environments, and configure its access controls.

Use this page to:

* Authenticate requests to Novita AI with a Bearer API key.
* Create an API key in the console and store it safely.
* Set the key as an environment variable on Linux, macOS, or Windows.
* Check how long a key stays valid and which key operations the OpenAPI supports.
* Configure model and network access policies for a key.

## Authentication

Novita AI uses Bearer authentication for API access. Send your API key in the `Authorization` request header:

```
Authorization: Bearer <API Key>
```

An example request:

```bash theme={"system"}
curl "https://api.novita.ai/openai/v1/chat/completions" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $NOVITA_API_KEY" \
  -d '{
    "model": "deepseek/deepseek-r1",
    "messages": [{"role": "user", "content": "Hello"}]
  }'
```

## Create an API key

<Steps>
  <Step title="Open Key Management">
    Go to [Key Management](https://novita.ai/settings/key-management?utm_source=getstarted) in the console.
  </Step>

  <Step title="Create a new key">
    Select **Create API Key**, then give the key a name that reflects its purpose, such as `production` or `local-testing`.
  </Step>

  <Step title="Copy and store the key">
    The full key is shown only once, when it is created. Copy it immediately and store it in a secure location, such as a secrets manager or an environment variable. If you lose it, you cannot recover it; create a new key instead.
  </Step>
</Steps>

## Configure access controls

Access controls are optional and configured per API key:

* [Model Access for API Keys](/guides/llm-model-access) controls which models a key can call within your team's enabled model range.
* [Network Access for API Keys](/guides/llm-network-access) controls which source IPs can use a key for model invocation.

The dedicated guides explain policy behavior, permissions, configuration, and rejection errors.

## Key format and validity

* Every key begins with the `sk_` prefix.
* A key is shown in full only once, when it is created. After that, the console shows a masked form.
* Each account can create up to **10** API keys.

When you create a key, choose one of four expiration options: **Permanent / 90 days / 30 days / 24 hours**.

<Note>
  You set the expiration when you create the key. It **cannot be changed** afterward: you cannot renew a key or expire it immediately. **Permanent** keys remain valid indefinitely, so a leaked key remains usable for longer. Use permanent keys only when appropriate. Expiration is configured in the console only; the OpenAPI does not create keys or set, change, or remove their expiration.
</Note>

An expired key is rejected when used, but its configuration remains visible and the delete action is still available. Expiration is different from disabling a key. To restore access, create a new key. To disable a key before it expires, delete it in the console; the deletion takes effect immediately.

## What the OpenAPI covers

You create and delete API keys in the console only. The Novita OpenAPI has no endpoints for creating or deleting keys, and it does not support configuring a key's expiration.

The key-related OpenAPI endpoints let you list keys and manage their model and network access policies:

* [List API Keys](/api-reference/key-list-with-model-access) — list the keys on your team, with an optional model access summary.
* [Get API Key Model Access Policy](/api-reference/key-get-model-access-policy) — read a single key's model access policy.
* [Set API Key Model Access Policy](/api-reference/key-put-model-access-policy) — set or update a key's model access policy.
* [Reset API Key Model Access Policy](/api-reference/key-delete-model-access-policy) — reset a key's model access policy to the default. This resets the policy only; it does not delete the key itself.
* [Get API Key IP Access Policy](/api-reference/key-get-ip-access-policy) — read a single key's network access policy.
* [Set API Key IP Access Policy](/api-reference/key-put-ip-access-policy) — set or update a key's allowed source IPs.
* [Delete API Key IP Access Policy](/api-reference/key-delete-ip-access-policy) — clear a key's network access policy, restoring no source-IP restriction.

## Store your key as an environment variable

Hardcoding a key in source code can expose it, for example when you commit the file. Reading it from an environment variable such as `NOVITA_API_KEY` keeps it out of your source code.

### Temporary vs. permanent

A key set with `export` (Linux/macOS) or `set` (Windows) lasts only for the current terminal session and is gone when you close it. This is suitable for a quick test. To keep the key across sessions, set it permanently as shown below, then open a new terminal for the change to take effect.

<CodeGroup>
  ```bash Linux theme={"system"}
  # Temporary: current session only
  export NOVITA_API_KEY="<Your API Key>"

  # Permanent: append to your shell profile, then reload
  echo 'export NOVITA_API_KEY="<Your API Key>"' >> ~/.bashrc
  source ~/.bashrc
  ```

  ```bash macOS theme={"system"}
  # Temporary: current session only
  export NOVITA_API_KEY="<Your API Key>"

  # Permanent: append to your shell profile, then reload
  # Newer macOS uses zsh (~/.zshrc); older setups use bash (~/.bash_profile)
  echo 'export NOVITA_API_KEY="<Your API Key>"' >> ~/.zshrc
  source ~/.zshrc
  ```

  ```powershell Windows theme={"system"}
  # Temporary: current PowerShell session only
  $env:NOVITA_API_KEY = "<Your API Key>"

  # Permanent: persist for the current user, then open a new terminal
  setx NOVITA_API_KEY "<Your API Key>"
  ```
</CodeGroup>

Read the key from the environment in your code:

<CodeGroup>
  ```python Python theme={"system"}
  import os
  from openai import OpenAI

  client = OpenAI(
      base_url="https://api.novita.ai/openai",
      api_key=os.environ.get("NOVITA_API_KEY"),
  )
  ```

  ```javascript Node.js theme={"system"}
  import OpenAI from "openai";

  const client = new OpenAI({
    baseURL: "https://api.novita.ai/openai",
    apiKey: process.env.NOVITA_API_KEY,
  });
  ```
</CodeGroup>

### The variable is set but the code still can't find it

<AccordionGroup>
  <Accordion title="You set it temporarily and opened a new terminal">
    A key set with `export` or `$env:` exists only in the terminal session where you ran the command. A new terminal or tab does not inherit it. Set the key permanently (`>> ~/.zshrc`, `setx`), or run the `export`/`$env:` command again in the session you are using.
  </Accordion>

  <Accordion title="You set it permanently but didn't restart">
    A permanent change (a shell profile or `setx`) applies to terminals started after the change. Open a new terminal, then restart your IDE or editor so it can read the updated environment. On Windows, `setx` does not affect terminals that are already open.
  </Accordion>

  <Accordion title="A service manager doesn't inherit your shell environment">
    Processes launched by `systemd`, `supervisor`, Docker, or a CI runner do not read your interactive shell profile. Set the variable in the service's own configuration, such as a `systemd` unit's `Environment=`, a `docker run -e` flag, or the CI project's secrets, rather than in `~/.bashrc`.
  </Accordion>

  <Accordion title="You ran the command under sudo">
    `sudo` does not pass your environment through by default, so a variable exported by your user is not visible to the elevated process. Use `sudo -E` to preserve the environment, or set the variable in the elevated context.
  </Accordion>
</AccordionGroup>

## Related

* [Common Error Codes](/guides/error) — resolve `401` and `403` responses related to keys.
* [Rate limits](/guides/llm-rate-limits) — request and token limits that apply to your account.