API Keys
Every API request to Backbone needs an API key. Here is how to create, use, and manage them.
Creating a Key
Head to API Keys in the sidebar and click Create API Key. You'll see the full key exactly once —copy it and store it somewhere safe.
Save your key immediately
After creation, only the key prefix is visible. If you lose the full key, you'll need to create a new one.
Key Format
All API keys start with sk_:
sk_live_abc123def456...
Using Your Key
Include the key as a Bearer token in the Authorization header:
Usage
curl -X POST https://backbone.manfred-kunze.dev/api/v1/chat/completions \
-H "Content-Type: application/json" \
-H "Authorization: Bearer sk_your_api_key" \
-d '{
"model": "gpt-4o",
"messages": [{"role": "user", "content": "Hello!"}]
}'
Environment Variables
Never commit API keys to source control
Use environment variables or a secrets manager. Never hardcode keys in your code.
# Set the environment variable
export BACKBONE_API_KEY="sk_your_api_key"
Then use it in your code:
Environment variable usage
import os
from openai import OpenAI
client = OpenAI(
api_key=os.environ["BACKBONE_API_KEY"],
base_url="https://backbone.manfred-kunze.dev/api/v1"
)
Managing Keys
In the API Keys page you can:
- Create new keys for different environments or services
- View key prefixes and creation dates
- Revoke keys that are no longer needed
One key per service
Create separate keys for different environments (dev, staging, prod) and services. Makes it easy to rotate or revoke without affecting everything.
Security Best Practices
- Rotate keys regularly —especially if team members leave
- One key per service —makes it easy to revoke without affecting other integrations
- Monitor usage —check the dashboard for unexpected activity
- Revoke immediately if a key is compromised
Error Responses
| Status | Meaning |
|---|---|
401 Unauthorized | Missing or invalid API key |
403 Forbidden | Valid key, but insufficient permissions for this action |
{
"error": {
"message": "Invalid API key",
"type": "authentication_error",
"code": "invalid_api_key"
}
}