Skip to main content
Nodepick uses API key authentication for all programmatic access. Every request you make through the Python SDK or HTTP API must include a valid API key. This page explains how to generate a key, how to pass it correctly, and how to keep it secure.

​
Getting an API Key

You generate API keys from the Nodepick dashboard. Follow these steps:
  1. Log in to your account at nodepick.ai
  2. Open the Dashboard and navigate to Developer Settings
  3. Click Create API Key
  4. Give the key a descriptive name (for example, local-dev or ci-pipeline)
  5. Copy the key immediately — it will not be shown again after you leave the page
You can create multiple keys for different environments or applications and revoke any of them independently from the same settings page.

​
Using Your API Key with the Python SDK

Pass your API key to the nodepick constructor when you initialize a client:
Every SDK method called on client will automatically include your key in the request headers. You do not need to handle authentication yourself beyond this single initialization step.

​
Using Your API Key with the HTTP API

Include your API key as a Bearer token in the Authorization header of every request:
This pattern applies to all HTTP API endpoints. Replace YOUR_API_KEY with the key you generated in the dashboard.

​
Keeping Your API Key Secure

Never commit your API key to source code or check it into version control. If a key is exposed in a public repository, revoke it immediately from Developer Settings and generate a new one.
The recommended approach is to load your API key from an environment variable at runtime:
Set the environment variable in your shell or CI environment before running your script:
For local development, you can store the variable in a .env file and load it with a library like python-dotenv. Make sure to add .env to your .gitignore so it is never committed.

​
Common Authentication Errors

If you receive a 401, double-check that the key is being passed correctly and that it has not been revoked. If you receive a 403, verify that the key you are using was created with the appropriate access level.

​
Rotating a Compromised Key

If you suspect a key has been exposed, revoke it immediately from Developer Settings and replace it with a new one. Because Nodepick supports multiple API keys, you can create a replacement before deleting the old key — this avoids any downtime in services that depend on it.