API Keys

An API key is what authenticates every call to the Grafilab Inference API and every run in the Playground. Keys are per account, there is no limit on how many you hold, and each one carries its own usage history — so a key per project or per environment costs nothing and makes spend easy to read.

In the console open API. The page is titled API Management and your keys sit under API Secret Keys, in a table with Name, Key, Created Date, and Actions columns.

Above the table, the API Endpoint row shows the base URL with a copy button: https://llm.grafilab.ai/v1.

In the Key column the value is masked down to its last four characters. Show Key reveals the full value and there is a copy button beside it, so a key you created earlier is still readable from this table.

If you have never created a key, opening this page mints one for you named Default. That is expected; use it, or create your own and delete it.

Further down the same page, Sample API Implementation gives ready-made snippets in Python, CURL, and TypeScript for Text Generation, Image Generation, Image Edit, Video Generation, and Image to Video, pre-filled with the endpoint and your selected model.

1. On API, click Generate New Key. A new row appears at the top of the table with a name field; the Key column reads will be generated.

2. Type a name — up to 100 characters, and unique among your active keys. Press Enter to submit, or Esc to cancel.

3. The API Key Created dialog shows Key Name and the full Key. Copy it now, then click I’ve saved my key.

New keys look like sk-grafilab- followed by 48 hexadecimal characters. Keys issued before that format are still valid and still authenticate — rotating one is how you move it to the current format.

Send the key as a header. Which header depends on the dialect your client speaks:

• OpenAI surface — Authorization: Bearer <api-key>.
• Anthropic surface — x-api-key: <api-key>, or Authorization: Bearer if that is easier. Whichever header is present decides the check: a malformed x-api-key fails on that value and does not fall back to Authorization.

curl https://llm.grafilab.ai/v1/models \
  -H "Authorization: Bearer $GRAFILAB_API_KEY"

import os
from openai import OpenAI

client = OpenAI(
    api_key=os.environ["GRAFILAB_API_KEY"],
    base_url="https://llm.grafilab.ai/v1",
)

import OpenAI from "openai";

const client = new OpenAI({
  apiKey: process.env.GRAFILAB_API_KEY,
  baseURL: "https://llm.grafilab.ai/v1",
});

A rejected key comes back as 401 with code invalid_api_key. The most common cause is a stray space or newline picked up when pasting.

Both actions live in the row’s Actions column and both are immediate.

Rotate Key opens Rotate API Key: Are you sure you want to rotate this key? The existing key value will immediately stop working. All in-flight requests using the old value will fail. Confirm and the API Key Created dialog shows the new value once.

Rotation keeps the same key record — its id, its name, and its whole usage history carry over, so your usage charts do not break. Only the secret changes.

Delete Key opens Delete API Key: Are you sure you want to delete this key? This action will invalidate the key, but historical usage data will be preserved.

Deletion is a soft delete with no undo: the key stops authenticating at once, its past usage stays in your reports, and the value cannot be brought back. If you only need to invalidate a leaked secret, rotate instead — you keep the history under the same name.

Every request is attributed to the key that authenticated it, so per-key reporting is exact rather than estimated.

Keys belong to the account, not to the person who made them: a team member acting on your account creates keys in your account, and they survive that member leaving unless you tick Also revoke the API keys this member created when you remove them.

Click View Usage on a key’s row to open Inference API Usage filtered to it — see Inference Usage for how to read it.