> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nemu.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> The credential your applications send

A gateway key authenticates requests to api.nemu.cc. It is the only credential
your code needs, and it reveals nothing about the provider keys behind it.

## Creating one

| Field       | Notes                                  |
| ----------- | -------------------------------------- |
| Name        | 4 to 32 characters, unique to you      |
| Description | Optional, up to 256 characters         |
| Expiration  | Optional. Blank means it never expires |

The key looks like `sk_xxxxx-xxxxx.` followed by 40 characters.

**It is shown once.** Copy it when it is created. Afterwards the console shows
only the first ten characters, and the rest cannot be recovered.

## What a key can reach

A key belongs to one account and one workspace. Through it a caller reaches
every gateway endpoint, and exactly the providers and models enabled in that
workspace.

There are no per key scopes. If one application should reach a different set of
models than another, give them keys in different workspaces.

Send it as either header. Both work everywhere.

```
Authorization: Bearer sk_...
x-api-key: sk_...
```

## How it is stored

Sealed into the same vault as your provider keys. The database holds a hash for
lookup and the first ten characters for display, never the key. Verification
compares in constant time.

Validated keys are cached briefly, so revoking one takes effect within about a
minute rather than instantly.

## Limits

There is no cap on how many keys you create.

Rate limits are per account and per plan, not per key, so ten keys share one
budget rather than getting ten. See [Plans](/plans).

A key stops working if the account or the workspace owner is suspended.