Before you start
Sign into your own customer account. API keys can expose account resources and must be treated as secrets.
Steps
- Open API keys in Developer tools and create a key with the intended name and available scope/expiry settings.
- Copy it into your secret manager at creation time and keep it out of source control, URLs, screenshots, and support tickets.
- Use Authorization: Bearer with the customer API key for console API requests.
- Set X-Account-ID for a specific account you belong to when your user has multiple memberships.
- Start with a read-only account or service request. Revoke unused or exposed keys and update your clients.
Check the result
The authenticated API lists only resources the user can access in the selected account.
Troubleshooting
401 indicates an authentication problem; 403 can mean account or permission denial. A GPU application token, object-storage secret, and console API key serve different systems.