> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nodepick.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Key Authentication for Nodepick SDK and HTTP API

> Learn how to generate and manage Nodepick API keys, authenticate requests with the Python SDK and HTTP API, and follow best practices to keep keys secure.

Nodepick uses API key authentication for all programmatic access. Every request you make through the Python SDK or HTTP API must include a valid API key. This page explains how to generate a key, how to pass it correctly, and how to keep it secure.

## Getting an API Key

You generate API keys from the Nodepick dashboard. Follow these steps:

1. Log in to your account at [nodepick.ai](https://www.nodepick.ai)
2. Open the **Dashboard** and navigate to **Developer Settings**
3. Click **Create API Key**
4. Give the key a descriptive name (for example, `local-dev` or `ci-pipeline`)
5. Copy the key immediately — it will not be shown again after you leave the page

You can create multiple keys for different environments or applications and revoke any of them independently from the same settings page.

## Using Your API Key with the Python SDK

Pass your API key to the `nodepick` constructor when you initialize a client:

```python theme={null}
from nodepick import nodepick

client = nodepick(api_key="YOUR_API_KEY")
```

Every SDK method called on `client` will automatically include your key in the request headers. You do not need to handle authentication yourself beyond this single initialization step.

## Using Your API Key with the HTTP API

Include your API key as a `Bearer` token in the `Authorization` header of every request:

```bash theme={null}
curl -X GET https://api.nodepick.ai/nodes \
  -H "Authorization: Bearer YOUR_API_KEY"
```

This pattern applies to all HTTP API endpoints. Replace `YOUR_API_KEY` with the key you generated in the dashboard.

## Keeping Your API Key Secure

<Warning>
  Never commit your API key to source code or check it into version control. If a key is exposed in a public repository, revoke it immediately from Developer Settings and generate a new one.
</Warning>

The recommended approach is to load your API key from an environment variable at runtime:

```python theme={null}
import os
from nodepick import nodepick

client = nodepick(api_key=os.environ["NODEPICK_API_KEY"])
```

Set the environment variable in your shell or CI environment before running your script:

```bash theme={null}
export NODEPICK_API_KEY="YOUR_API_KEY"
```

For local development, you can store the variable in a `.env` file and load it with a library like [`python-dotenv`](https://pypi.org/project/python-dotenv/). Make sure to add `.env` to your `.gitignore` so it is never committed.

## Common Authentication Errors

| Status Code        | Error                      | Cause                                                                       |
| ------------------ | -------------------------- | --------------------------------------------------------------------------- |
| `401 Unauthorized` | Invalid or missing API key | The key was not included in the request, or the key value is incorrect      |
| `403 Forbidden`    | Insufficient permissions   | The key exists but does not have permission to perform the requested action |

If you receive a `401`, double-check that the key is being passed correctly and that it has not been revoked. If you receive a `403`, verify that the key you are using was created with the appropriate access level.

## Rotating a Compromised Key

<Tip>
  If you suspect a key has been exposed, revoke it immediately from Developer Settings and replace it with a new one. Because Nodepick supports multiple API keys, you can create a replacement before deleting the old key — this avoids any downtime in services that depend on it.
</Tip>