How should I create, store and rotate my ModelRiver API keys?
Create one key per app or environment under Settings → API Keys, keep it on your server, and rotate it by creating a new key before revoking the old one. Keys start with mr_live_ and belong to a single project.
I lost my key. Can I see it again?#
No. A key is shown only once, when you create it, and ModelRiver stores only a fingerprint of it, not the key itself. Create a new key and revoke the lost one.
Should keys expire?#
They can. Choose 1, 7, 30, 60 or 90 days, or Never. Short expiry is good for temporary access or contractors; long-lived production keys are fine if you rotate them regularly.
How do I rotate a key without downtime?#
- Create a new key.
- Deploy it to your app.
- Revoke the old key once traffic has moved over.
Revoking takes effect immediately, and requests with a revoked or expired key get 401.
Can I use my API key in the browser?#
No. Anyone can read a key shipped in frontend code. Call ModelRiver from your server instead. To stream to the browser, use an async request and pass only the one-time ws_token to the frontend. See Should I use sync, async or streaming?
Is this the same as my OpenAI or Anthropic key?#
No. Provider keys are added under Settings → Providers and are used only by ModelRiver to call that provider. Your app only ever uses the ModelRiver key.