API Key Authentication

nodepick.ai uses API key authentication for all programmatic access. Every request you make through the Python SDK or HTTP API must include a valid API key passed as a Bearer token in the Authorization header.

Getting an API Key

You generate API keys from the nodepick.ai dashboard. Follow these steps:

If you don’t have an account yet, register at nodepick.ai and log in.
Set up your credit card in the dashboard.
In the left-hand navigation, open Developer, then go to API Keys.
Click Generate and give the key a descriptive name (for example, dev or ci-pipeline).
Copy and save the key immediately — it will not be shown again after you leave the page.

You can create multiple keys for different environments or applications and revoke any of them independently from the same settings page.

Using Your API Key with the Python SDK

Pass your API key to the nodepick constructor when you initialize a client:

from nodepick import nodepick

client = nodepick(api_key="YOUR_API_KEY")

Every SDK method called on client automatically includes your key in request headers.

Using Your API Key with the HTTP API

Include your API key as a Bearer token in the Authorization header of every HTTP request:

curl -X GET https://api.nodepick.ai/nodes \
  -H "Authorization: Bearer YOUR_API_KEY"

Replace YOUR_API_KEY with the key generated in the dashboard.

Keeping Your API Key Secure

Never commit your API key to source code or check it into version control. If a key is exposed in a public repository, revoke it immediately from Developer Settings and generate a new one.

The recommended approach is to load your API key from an environment variable at runtime:

import os
from nodepick import nodepick

client = nodepick(api_key=os.environ["NODEPICK_API_KEY"])

Set the environment variable in your shell or CI environment before running your script:

export NODEPICK_API_KEY="YOUR_API_KEY"

For local development, store the variable in a .env file and load it with python-dotenv. Ensure .env is listed in your .gitignore file so it is never committed.

Rotating Keys

If you suspect a key has been compromised:

Open Developer Settings in the dashboard.
Click Generate to create a replacement key.
Update your applications or environment variables with the new key.
Delete the old key. Key deletion is immediate and permanent — any request sent with a deleted key returns a 401 Unauthorized error.

Common Authentication Errors

Status Code	Error	Cause	Solution
`401 Unauthorized`	Invalid or missing API key	The key was omitted, malformed, or revoked	Verify that the `Authorization` header is formatted as `Bearer YOUR_API_KEY` and that the key is active
`403 Forbidden`	Insufficient permissions	The key is valid but lacks permissions	Review the key’s permission scope in Developer Settings and adjust as needed

All authentication error responses return a consistent JSON payload:

{
  "error": {
    "code": "unauthorized",
    "message": "Invalid or missing API key"
  }
}

Overview

Nodes

Getting an API Key

Using Your API Key with the Python SDK

Using Your API Key with the HTTP API

Keeping Your API Key Secure

Rotating Keys

Common Authentication Errors

​Getting an API Key

​Using Your API Key with the Python SDK

​Using Your API Key with the HTTP API

​Keeping Your API Key Secure

​Rotating Keys

​Common Authentication Errors

Getting an API Key

Using Your API Key with the Python SDK

Using Your API Key with the HTTP API

Keeping Your API Key Secure

Rotating Keys

Common Authentication Errors