> ## Documentation Index
> Fetch the complete documentation index at: https://mulerouter.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Get an API key, secure it, and use it on every request

Every MuleRouter endpoint requires an API key, passed in the
`Authorization` request header.

## Get an API key

<Steps>
  <Step title="Open the API Keys tab">
    Sign in to the [MuleRouter Console](https://www.mulerouter.ai/app/api-keys)
    and open the **API Keys** tab.
  </Step>

  <Step title="Generate a new key">
    Click **Generate new key**. The console shows the full key string
    exactly once — copy it to a secret store immediately.
  </Step>

  <Step title="(Optional) Restrict the key">
    Add a description so you remember what the key is for. Rotate or
    revoke individual keys at any time from the same page.
  </Step>
</Steps>

<Warning>
  The full API key is shown only once at creation. If you lose it, you
  cannot recover it — generate a new one and rotate.
</Warning>

## Send authenticated requests

Include the key as a Bearer token in the `Authorization` header:

```
Authorization: Bearer <API Key>
```

A minimal cURL request:

```bash highlight={3} theme={null}
curl https://api.mulerouter.ai/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $MULEROUTER_API_KEY" \
  -d '{"model":"gpt-5.5","messages":[{"role":"user","content":"hi"}]}'
```

The same header works for every endpoint — LLM, image, video, speech,
music, async tasks, and the task-status `GET` URLs.

## SDK setup

Most OpenAI-compatible SDKs accept a `base_url` override. Point it at
MuleRouter and they "just work":

<CodeGroup>
  ```python OpenAI Python theme={null}
  from openai import OpenAI

  client = OpenAI(
      api_key=os.environ["MULEROUTER_API_KEY"],
      base_url="https://api.mulerouter.ai/v1",
  )
  ```

  ```ts OpenAI Node theme={null}
  import OpenAI from "openai";

  const client = new OpenAI({
    apiKey: process.env.MULEROUTER_API_KEY,
    baseURL: "https://api.mulerouter.ai/v1",
  });
  ```
</CodeGroup>

## Best practices

* **Never commit keys to source control.** Use environment variables,
  `.env` files (gitignored), or a secret manager.
* **Rotate aggressively.** Generate a new key when a teammate leaves,
  when you suspect a leak, or on a fixed cadence.
* **One key per workload.** Per-service keys make leaks easy to scope and
  revoke without disrupting unrelated traffic.
* **Server-side only.** Treat the key like a database password — never
  ship it in a browser bundle or mobile app.

## Errors

| HTTP                    | Meaning                              | Likely cause                                           |
| ----------------------- | ------------------------------------ | ------------------------------------------------------ |
| `401 Unauthorized`      | Missing, malformed, or revoked key   | Check the `Authorization` header is `Bearer <key>`     |
| `402 Payment Required`  | Insufficient balance                 | Top up in the [Console](https://www.mulerouter.ai/app) |
| `429 Too Many Requests` | Rate limit / quota / daily-spend cap | Slow down or raise the limit                           |

The full code list lives in [Error codes](/docs/get-started/error-codes).