> ## Documentation Index
> Fetch the complete documentation index at: https://docs.metrixllm.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create and use API keys to authenticate requests to the MetrixLLM gateway.

All requests to the gateway must be authenticated with a `Bearer` token — your MetrixLLM API key.

## Creating a key

<Steps>
  <Step title="Open your Workspace">
    Log into [app.metrixllm.com](https://app.metrixllm.com) and select the workspace you want to create a key for.
  </Step>

  <Step title="Go to API Keys">
    Click **API Keys** in the left sidebar.
  </Step>

  <Step title="Create and copy">
    Click **Create API Key**, give it a name (e.g. `Backend - Production`), and click **Create**. Copy the key immediately — it is shown only once.
  </Step>
</Steps>

<Warning>
  API keys are displayed **only at the moment of creation**. If you lose a key, revoke it and create a new one. Never commit keys to source control — use environment variables.
</Warning>

## Key format

MetrixLLM API keys always start with `mtx_`. This prefix makes them easy to identify and never confused with a raw provider key like `sk-...`.

## Using your key

Pass the key as a `Bearer` token in the `Authorization` header:

<CodeGroup>
  ```python Python theme={null}
  from openai import OpenAI

  client = OpenAI(
      base_url="https://gateway.metrixllm.com/openai/v1",
      api_key="mtx_..."
  )
  ```

  ```typescript Node.js theme={null}
  import OpenAI from "openai";

  const client = new OpenAI({
    baseURL: "https://gateway.metrixllm.com/openai/v1",
    apiKey: "mtx_...",
  });
  ```

  ```bash cURL theme={null}
  curl https://gateway.metrixllm.com/openai/v1/chat/completions \
    -H "Authorization: Bearer mtx_..." \
    -H "Content-Type: application/json" \
    -d '{"model": "gpt-4o", "messages": [{"role": "user", "content": "Hello"}]}'
  ```
</CodeGroup>

## Revoking a key

Navigate to **API Keys** in your workspace and click **Revoke** next to any key. It is invalidated immediately — active requests using it will fail with `401 Unauthorized` within seconds.

## Key scoping

Keys are scoped to the workspace they were created in. A key from your `Production` workspace cannot access logs or routing rules from `Staging`. For additional role restrictions, see [RBAC](/docs/rbac).