API keys and authentication

Every product request uses a project API key, including free endpoints. Pass it in the HTTP Authorization header:

Authorization: Bearer <your-platform-api-key>

Create and manage keys in Console for the intended organization and project. The Gateway checks the key, project state, and access to the requested operation. An existing asynchronous job remains scoped to its original project; a key from another project cannot access it.

Store keys securely

Keep keys in a server-side secret manager or protected local environment. The examples use ANTAPI_KEY for your secret and call the official Gateway at https://api.antapi.dev.

Never place a key in a query string, browser code, public environment variable, analytics event, or request log. Send requests over HTTPS in production. Console's session cookie authenticates Console access; it does not replace an API key for product calls. Do not send internal service authentication headers.

Rotate and revoke

Save the full key when it is first issued. Console displays only its identifying prefix and last four characters afterward.

If a key is exposed, revoke it in Console, create a replacement, and update your application's secret. Use separate keys where application access needs to be revoked or rotated independently.

Diagnose an authentication failure

For HTTP 401, verify that the header is present, the key has not been revoked, and the organization and project are available. Avoid logging the key while investigating. See errors and recovery for other status codes.

Authentication identifies your project. An idempotency key separately identifies a logical operation and lets you retry it safely.