# Authentication

The public inference API uses a SimpleLLM API key in the HTTP Authorization header. A dashboard login session is not a replacement for that key.

## Create and use a key

1. Sign in to the [dashboard](https://app.simplellm.eu).
2. Open API Keys and create a named key for the application.
3. Copy the secret when shown and store it in your application's secret configuration.
4. Send the key with each request.

~~~http
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json
~~~

The Content-Type above is for JSON requests. Audio uploads use multipart form data, and GET requests do not need a JSON body.

## Store credentials safely

Use environment variables or a secret manager on your backend. Never embed a secret in a frontend bundle, public repository, URL query string, screenshot, or support report.

~~~bash
export SIMPLELLM_API_KEY='YOUR_API_KEY'
curl --fail-with-body https://api.simplellm.eu/v1/keys/current \
  -H "Authorization: Bearer $SIMPLELLM_API_KEY"
~~~

This read-only endpoint returns metadata for the key used to authenticate; it does not return the secret again.

## Separate applications and environments

Use separate keys for development and production and for different integrations. That makes key-specific usage easier to attribute and lets you revoke one integration's credential without changing all applications.

Account-level limits still apply across keys. Creating more keys does not create more account capacity.

## Rotate a key

Create a replacement key, update the application's secret, verify a small request, then revoke the old key in the dashboard. Do not revoke the old key before the application has switched unless it is compromised and immediate revocation is necessary.

## Authentication failures

`401` indicates missing or invalid credentials. Check the full header, whitespace, the selected environment, and whether the key was revoked. A `402` is a credit problem, not a malformed authentication header.

See [troubleshooting](/docs/errors.html) for other failures and [API key metadata](/docs/reference/getCurrentKey.html) for returned fields.