> ## Documentation Index
> Fetch the complete documentation index at: https://docs.routeway.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Learn how to authenticate with the Routeway API using your API key.

All requests to the Routeway API must be authenticated using an API key. This key acts as your unique identifier and provides access to your account's usage and billing.

<Callout type="warning">
  Never expose your API key publicly. Anyone with access to your key can use
  your quota and rack up charges.
</Callout>

***

## Get Your API Key

<Tip>
  New to APIs? You don't need any code to get started — just grab a key below and paste it into your chat app's settings. See our [Integrations Guide](/integrations/overview#chat-uis) or [Roleplay Platforms Guide](/integrations/overview#roleplay-platforms) for setup steps.
</Tip>

<Steps>
  <Step title="Log In">
    Go to the [Routeway dashboard](https://routeway.ai/dashboard) and sign in to your
    account.
  </Step>

  <Step title="Navigate to API Keys">
    Once you're logged in, open the **API Keys** tab from the sidebar.
  </Step>

  <Step title="Create a New Key">
    Click **Create API Key**, give it a name (e.g. `local-dev`, `production`), and
    click **Confirm**.
  </Step>

  <Step title="Copy and Store the Key">
    Copy your new API key and store it securely — preferably in a `.env` file or a
    secret manager like AWS Secrets Manager or HashiCorp Vault.
  </Step>
</Steps>

***

## Set Your API Key

You must make your API key available to your application. We recommend using environment variables to avoid hardcoding the key into your source code.

<Tabs>
  <Tab title="Linux / macOS">
    ```bash theme={null}
    export ROUTEWAY_API_KEY="your_key_here"
    ```
  </Tab>

  <Tab title="Windows">
    ```bash theme={null}
    setx ROUTEWAY_API_KEY "your_key_here"
    ```

    <Callout type="note">
      Use `set` instead of `setx` if you only want to set the key for the current
      session:
    </Callout>

    ```bash theme={null}
    set ROUTEWAY_API_KEY=your_key_here
    ```
  </Tab>
</Tabs>

***

## Authenticate in Code

<Tabs>
  <Tab title="Python">
    ```python theme={null}
    import os
    from openai import OpenAI

    client = OpenAI(
      api_key=os.getenv("ROUTEWAY_API_KEY"),
      base_url="https://api.routeway.ai/v1"
    )
    ```
  </Tab>

  <Tab title="Node.js">
    ```javascript theme={null}
    import OpenAI from 'openai'

    const openai = new OpenAI({
    	apiKey: process.env.ROUTEWAY_API_KEY,
    	baseURL: 'https://api.routeway.ai/v1',
    })
    ```
  </Tab>

  <Tab title="cURL">
    ```bash theme={null}
    curl https://api.routeway.ai/v1/chat/completions \
      -H "Authorization: Bearer $ROUTEWAY_API_KEY" \
      -H "Content-Type: application/json" \
      -d '{
        "model": "gpt-4o-mini",
        "messages": [{"role": "user", "content": "Hello, world!"}]
      }'
    ```
  </Tab>
</Tabs>

***

## API Key Format & Security

<Callout type="info">
  Routeway API keys usually begin with `sk-` and are 32+ characters long.
</Callout>

* Keep your keys secret.
* Never push them to GitHub (add `.env` to your `.gitignore`).
* Rotate keys regularly and revoke any you no longer use.

***

## Common Errors

<Tabs>
  <Tab title="401 - Unauthorized">
    ```json theme={null}
    {
    	"error": {
    		"message": "Invalid or missing API key",
    		"type": "error",
    		"tip": "Troubleshoot at: https://discord.gg/RjX2CpdPpd",
    		"code": 401
    	}
    }
    ```

    **Fix:** Make sure your `ROUTEWAY_API_KEY` is correctly set and passed to the client.
  </Tab>

  <Tab title="403 - Forbidden">
    ```json theme={null}
    {
    	"error": {
    		"message": "API key does not have access to this resource",
    		"type": "authorization_error",
    		"code": "forbidden"
    	}
    }
    ```

    **Fix:** Check your key’s permissions in the dashboard. Some features may be restricted.
  </Tab>
</Tabs>

***

## Best Practices

<CardGroup cols={2}>
  <Card title="Secure Storage" icon="lock">
    Store API keys in `.env` files and use a secrets manager in production. Never commit them to version control.
  </Card>

  <Card title="Key Management" icon="key">
    Regularly rotate API keys and limit their scopes to the minimum required permissions.
  </Card>

  <Card title="Monitoring" icon="activity">
    Keep an eye on your API usage.
  </Card>

  <Card title="Client-Side Security" icon="shield-alert">
    Never expose API keys in frontend code. Always make API calls from a backend service.
  </Card>
</CardGroup>