Find Your Roboflow API Key

Find your API Key to authenticate with the Roboflow API and Roboflow Inference

You can find your API Key at app.roboflow.com/settings/api

---

There are two kinds of API key:

• Private API Keys: used by Roboflow API and Roboflow Infernece

• Public / Publishable API Key: Used by inference.js , our JavaScript inference SDK

API keys are scoped to a Workspace, which means you must use the API key associated with a workspace to access that Workspace's private projects.

Click "Generate New Key" to issue a new key, or copy a key you have already created.

Be sure to keep your private API key secret. Treat it like a password; it grants the bearer access to your workspace's data and models.

If you ever accidentally expose your key to someone who isn't authorized to access your workspace, click "Roll API Key", which will disable previous API key and create a new one.

Multiple API Keys

Workspaces on Enterprise plans can create multiple API keys, allowing them to isolate environments and instantly revoke access for specific deployments or personnel without disrupting their entire production workflow.

Multiple API Key options for Enterprise Workspaces

We also offer Scoped API Keys as an Add-on to our Enterprise customers.

Default API Key

When a workspace has several keys, the app still uses one of them for code snippets and common workspace actions (ex: viewing model evaluation results). To choose it, check "Set as default API key for this workspace" when you generate a key, or edit an existing key. That key then shows a "Default" badge in the key list. Choosing a default requires the Advanced API Keys feature.

The default key must keep the permissions those actions need: workspace:read, project:read, version:read, image:read, and model:infer. Roboflow adds them for you and locks them while the key stays the default. If you clear the checkbox, those permissions stay on the key, but you can then remove them. A folder-scoped key cannot be the default.

If no key is set as the default, the app falls back to the oldest enabled workspace key that has those permissions, and that key shows an "In Use" badge instead. Check the badge before you disable or revoke a key, so you know which one your workspace actions and billed usage run under.

If no key has those permissions, the key list shows a warning. Until you generate a full-access key, or set an existing key as the default, actions the app runs for you fail. This includes running models, running and previewing Workflows, Auto Label, model evaluation, and dataset exports.

Use your key with Roboflow Inference

Your API key grants access to the models you have trained on Roboflow, public models on Roboflow Universe, and the hosted inference APIs. There are several ways to supply it when using Roboflow Inference.

Environment variable

The recommended way is to set ROBOFLOW_API_KEY in your environment. In most terminals:

export ROBOFLOW_API_KEY=YOUR_API_KEY

Any command run in that terminal session then has access to the key. See Environment Variables for the other variables the CLI and SDK read.

Python

When using Inference from Python, the key can be passed as a keyword argument:

from inference import get_model

model = get_model(model_id="...", api_key="YOUR_API_KEY")

If the key is set in your environment, you do not have to pass it as an argument: model = get_model(model_id="...").

HTTP requests

When calling the server directly, send the key as an Authorization: Bearer header. The header keeps the key out of URLs, access logs, and browser history, and works the same on every route:

import requests

my_api_key = "YOUR_API_KEY"
headers = {"Authorization": f"Bearer {my_api_key}"}

url = "http://localhost:9001/soccer-players-5fuqs/1"
response = requests.post(url, headers=headers)

url = "http://localhost:9001/infer/object_detection"
payload = {"model_id": "soccer-players-5fuqs/1"}
response = requests.post(url, json=payload, headers=headers)

Self-hosted servers read the header from Inference release 1.5.0 onward. The hosted APIs accept it as well.

Passing the key as a URL parameter (?api_key=...) or as an api_key field in the request payload is the legacy channel. It still works on every server version, but is not recommended for new code:

url = f"http://localhost:9001/soccer-players-5fuqs/1?api_key={my_api_key}"
response = requests.post(url)

When several channels carry a key, the query parameter wins over the header, and the header wins over the body field.

When using the Python SDK, set the transport once on the client instead of building headers yourself: see API key transport.

Docker

If you run the Inference Server locally in a Docker container, provide the key in the docker run command:

docker run -it --rm --network=host -e ROBOFLOW_API_KEY=YOUR_API_KEY roboflow/roboflow-inference-server-cpu:latest

Requests sent to that server can then omit api_key from the request payload.

A self-hosted server does not require an API key by default. Setting one in the container does not restrict who may call the server: see Securing a Self-Hosted Server to enforce authentication.