API keys

Create and store a key

Create a key in the console and copy it into a trusted password manager or server environment variable. Use the controls shown in the key editor to limit its lifetime, model access or spending where available.

export NEON_API_KEY="YOUR_API_KEY"

For OpenAI-compatible requests, use Authorization: Bearer YOUR_API_KEY. Anthropic-compatible clients can use the gateway key through their configured auth token. See each protocol reference for headers.

Protect your key

Keep keys out of browser JavaScript, public repositories, screenshots and shared logs. The public documentation uses placeholders only; it does not need your real key. Browser-based applications should call an application backend rather than expose the key to every visitor.

Rotate or revoke

Create a replacement key, update the affected application, verify one request, then revoke the old key. Revoke a leaked key immediately and inspect usage logs. A deleted or expired key must also be replaced in every configured client.

Diagnose authentication failures

Check that you used a NeonAPI key, removed extra whitespace, and retained the Bearer prefix. Then inspect expiry, key restrictions, account state and balance in the console.