> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nodepick.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Authentication: Using Bearer Tokens with Nodepick

> All Nodepick API requests require a valid API key passed as an Authorization Bearer token. Learn how to obtain and use your API key.

Every request you make to the Nodepick API must include a valid API key. Nodepick uses Bearer token authentication — you pass your key in the `Authorization` header on each request. There are no session cookies or OAuth flows to manage; a single header is all you need.

## Get Your API Key

To generate an API key, log in to the Nodepick dashboard and navigate to **Developer Settings**. Click **Generate New Key**, give it a descriptive name, and copy the value immediately — the full key is only shown once at creation time.

## Pass Your Key on Every Request

Include your API key as a Bearer token in the `Authorization` header on every API call:

```bash theme={null}
curl https://api.nodepick.ai/nodes \
  -H "Authorization: Bearer YOUR_API_KEY"
```

<Warning>
  Never expose your API key in client-side code, public repositories, or anywhere outside of a secure server environment. Anyone who obtains your key can create and delete nodes on your account and incur charges on your behalf.
</Warning>

## Use an Environment Variable

The safest way to handle your API key is to store it in an environment variable rather than hardcoding it in your source files. Set the variable in your shell:

```bash theme={null}
export NODEPICK_API_KEY="your_api_key_here"
```

Then read it at runtime in your application:

```python theme={null}
import os
from nodepick import nodepick

client = nodepick(api_key=os.environ["NODEPICK_API_KEY"])
```

This approach keeps your key out of version control and lets you rotate it without touching your codebase.

## Auth Error Responses

If a request fails due to an authentication problem, you will receive one of the following responses:

* **401 Unauthorized** — Your API key is missing from the request or the value you provided is not a valid key. Double-check that you copied the full key from Developer Settings and that the `Authorization` header is formatted exactly as `Bearer YOUR_API_KEY`.
* **403 Forbidden** — Your API key is valid, but it does not have the permission scope required for the action you attempted. Review the key's scopes in **Developer Settings** and update them if necessary.

## Rotating Keys

If you suspect a key has been compromised, go to **Developer Settings** and generate a new key immediately. Update your applications to use the new key, then delete the old key from Developer Settings. Deletion is permanent — any request still using the old key will receive a `401` response.