API Key Management
API Keys are used to authenticate access to the Chat2API proxy server. Create, manage, and use keys to protect your proxy endpoint.
Overview
When API Key authentication is enabled, all requests to the proxy must include a valid API Key.
Enable Authentication
- Navigate to API Keys from the sidebar
- Toggle Enable Authentication
- Create at least one API Key
Enable authentication before exposing the proxy to the network to prevent unauthorized access.
Create API Key
Steps
- Click New API Key button
- Enter a name (e.g., "Production", "Development")
- Add optional description
- Click Create
Key Format
API Key format:
sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxPlease store your API Key securely. Store keys in environment variables, not in code.
Using API Key
Method 1: Authorization Header (Recommended)
curl http://localhost:8080/v1/chat/completions \
-H "Authorization: Bearer sk-xxxxxx" \
-H "Content-Type: application/json" \
-d '{"model": "gpt-4", "messages": [...]}'Method 2: X-API-Key Header
curl http://localhost:8080/v1/chat/completions \
-H "X-API-Key: sk-xxxxxx" \
-H "Content-Type: application/json" \
-d '{"model": "gpt-4", "messages": [...]}'Method 3: URL Parameter
curl "http://localhost:8080/v1/chat/completions?api_key=sk-xxxxxx" \
-H "Content-Type: application/json" \
-d '{"model": "gpt-4", "messages": [...]}'Using OpenAI SDK
from openai import OpenAI
client = OpenAI(
api_key="sk-xxxxxx",
base_url="http://localhost:8080/v1"
)Managing Keys
View Keys
The API Keys page displays:
- Key name
- Key value (click to view full key)
- Status (enabled/disabled)
- Usage count
- Created date
Copy Key
Click the copy button next to the key in the list to copy the full key.
Enable/Disable Key
- Find the key in the list
- Toggle the status switch
- Changes take effect immediately
Disabled keys will be rejected even if authentication is enabled.
Delete Key
- Find the key in the list
- Click Delete
- Confirm deletion
Deleting a key is permanent. Applications using that key will lose access.
Best Practices
| Practice | Description |
|---|---|
| Use Separate Keys | Create different keys for different applications for easier management and revocation |
| Regular Rotation | Rotate keys periodically for better security, recommended every 90 days |
| Monitor Usage | Check logs regularly for unusual activity to detect security issues early |
| Disable Unused Keys | Disable keys that are no longer needed to reduce security risks |
| Secure Storage | Store keys in environment variables, not in code |