Authentication - Endprompt

To call your Endprompt endpoints, you need an API key. This page covers creating, managing, and using API keys securely.

Creating an API Key

Navigate to API Keys

Click API Keys in the sidebar.

Click Create API Key

Click the Create API Key button.

Name Your Key

Give it a descriptive name:

Production - Web App
Development - Local
CI/CD Pipeline

Copy the Key

Copy the displayed key immediately. You won’t see it again!

API keys are shown only once at creation. Store them securely immediately. If you lose a key, create a new one.

Using Your API Key

Include your API key in the x-api-key header:

curl -X POST https://yourcompany.api.endprompt.ai/api/v1/summarize \
  -H "Content-Type: application/json" \
  -H "x-api-key: ep_live_xxxxxxxxxxxxxxxxxxxx" \
  -d '{"text": "Your content here"}'

const response = await fetch('https://yourcompany.api.endprompt.ai/api/v1/summarize', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'x-api-key': 'ep_live_xxxxxxxxxxxxxxxxxxxx'
  },
  body: JSON.stringify({ text: 'Your content here' })
});

import requests

response = requests.post(
    'https://yourcompany.api.endprompt.ai/api/v1/summarize',
    headers={
        'Content-Type': 'application/json',
        'x-api-key': 'ep_live_xxxxxxxxxxxxxxxxxxxx'
    },
    json={'text': 'Your content here'}
)

API Key Format

Endprompt API keys follow a consistent format:

ep_live_xxxxxxxxxxxxxxxxxxxx
│  │    └── Random characters
│  └── Environment (live/test)
└── Prefix

Managing API Keys

Viewing Keys

The API Keys page shows:

Column	Description
Name	Your descriptive name
Created	When the key was created
Last Used	Most recent API call
Status	Active or Revoked

For security, you cannot view the full key after creation. Only the last 4 characters are shown.

Revoking Keys

If a key is compromised:

Go to API Keys
Find the key to revoke
Click ⋯ → Revoke
Confirm the action

Revoking a key immediately invalidates it. Any applications using that key will start receiving 401 errors.

Rotating Keys

Best practice is to rotate keys periodically:

Create New Key

Create a new API key with a similar name.

Update Applications

Deploy the new key to your applications.

Verify

Confirm the new key works correctly.

Revoke Old Key

Revoke the previous key.

Security Best Practices

Never Expose Keys

Don’t commit keys to git or expose in client-side code

Use Environment Variables

Store keys in env vars, not hardcoded

Rotate Regularly

Create new keys and revoke old ones periodically

Use Separate Keys

Different keys for dev, staging, production

Environment Variables

Store your API key in environment variables:

ENDPROMPT_API_KEY=ep_live_xxxxxxxxxxxxxxxxxxxx

const apiKey = process.env.ENDPROMPT_API_KEY;

import os
api_key = os.environ.get('ENDPROMPT_API_KEY')

Key Naming Convention

Use descriptive names that identify:

Environment (Production, Staging, Development)
Application or service name
Purpose

Examples:

Production - Main API
Staging - Integration Tests
Development - Local Testing
CI/CD - GitHub Actions

Authentication Errors

401 Unauthorized

{
  "error": "unauthorized",
  "message": "Invalid or missing API key"
}

Causes:

Missing x-api-key header
Invalid API key
Revoked API key

Solutions:

Verify the header name is exactly x-api-key
Check for typos in the key
Confirm the key is active in your dashboard

403 Forbidden

{
  "error": "forbidden",
  "message": "Access denied to this endpoint"
}

Causes:

Key doesn’t have access to the endpoint
Endpoint is internal/private

Rate Limits Per Key

Each API key has its own rate limits:

Limit	Default
Per Minute	60 requests
Per Hour	1,000 requests
Per Day	10,000 requests

Contact support if you need higher limits for your use case.

Next Steps

Making Requests

Learn the request format

Code Examples

Complete examples in multiple languages

Admin API Keys

Create admin keys for management access and MCP

MCP Server

Connect AI coding tools to Endprompt

​Creating an API Key

​Using Your API Key

​API Key Format

​Managing API Keys

​Viewing Keys

​Revoking Keys

​Rotating Keys

​Security Best Practices

Never Expose Keys

Use Environment Variables

Rotate Regularly

Use Separate Keys

​Environment Variables

​Key Naming Convention

​Authentication Errors

​401 Unauthorized

​403 Forbidden

​Rate Limits Per Key

​Next Steps

Making Requests

Code Examples

Admin API Keys

MCP Server

Creating an API Key

Using Your API Key

API Key Format

Managing API Keys

Viewing Keys

Revoking Keys

Rotating Keys

Security Best Practices

Environment Variables

Key Naming Convention

Authentication Errors

401 Unauthorized

403 Forbidden

Rate Limits Per Key

Next Steps