Link to this sectionAPI Keys#

Ultralytics Platform API keys enable secure programmatic access for remote training, inference, and automation. Create named keys with AES-256-GCM encryption for different use cases.

Link to this sectionCreate API Key#

Create a new API key:

1. Go to Settings > API Keys
2. Click Create Key
3. Enter a name for the key (e.g., "Training Server")
4. Click Create Key

Link to this sectionKey Name#

Give your key a descriptive name:

• training-server - For remote training machines
• ci-pipeline - For CI/CD integration
• local-dev - For local development

Link to this sectionKey Display#

After creation, the key is displayed once:

Link to this sectionKey Format#

API keys follow this format:

• Prefix: ul_ identifies Ultralytics keys
• Body: 40 random hexadecimal characters
• Total: 43 characters

Link to this sectionKey Security#

• Keys are stored with AES-256-GCM encryption
• Authentication uses a SHA-256 hash for a fast indexed lookup
• Full key values are never stored in plaintext

Link to this sectionUsing API Keys#

Link to this sectionEnvironment Variable#

Set your key as an environment variable:

export ULTRALYTICS_API_KEY="YOUR_API_KEY"

Link to this sectionYOLO CLI#

Set the key using the YOLO CLI:

yolo settings api_key="YOUR_API_KEY"

Link to this sectionIn Code#

Use the key in your Python scripts:

import os

# From environment (recommended)
api_key = os.environ.get("ULTRALYTICS_API_KEY")

# Or directly (not recommended for production)
api_key = "YOUR_API_KEY"

Link to this sectionHTTP Headers#

Include the key in API requests:

curl -H "Authorization: Bearer YOUR_API_KEY" \
  https://platform.ultralytics.com/api/...

See the REST API Reference for all available endpoints.

Link to this sectionRemote Training#

Enable metric streaming with your key.

pip install "ultralytics>=8.4.60"

export ULTRALYTICS_API_KEY="YOUR_API_KEY"
yolo train model=yolo26n.pt data=coco.yaml project=username/project name=exp1

See Cloud Training for the complete remote training guide.

Link to this sectionManage Keys#

Link to this sectionView Keys#

All keys are listed on the Settings > API Keys tab:

Each key card shows the key name, the full decrypted key value (copyable), relative creation time, and a revoke button.

Link to this sectionRevoke Key#

Revoke a key that's compromised or no longer needed:

1. Find the key in the API Keys section
2. Click the Revoke (trash) button
3. Confirm revocation

Link to this sectionRegenerate Key#

If a key is compromised:

1. Create a new key with the same name
2. Update your applications
3. Revoke the old key

Link to this sectionWorkspace API Keys#

API keys are scoped to the currently active workspace:

• Personal workspace: Keys authenticate as your personal account
• Team workspace: Keys authenticate within the team context

When switching workspaces in the sidebar, the API Keys section shows keys for that workspace. Editor role or higher is required to manage workspace API keys. See Teams for role details.

Link to this sectionSecurity Best Practices#

Link to this sectionDo#

• Store keys in environment variables
• Use separate keys for different environments
• Revoke unused keys promptly
• Rotate keys periodically
• Use descriptive names to identify key purposes

Link to this sectionDon't#

• Commit keys to version control
• Share keys between applications
• Log keys in application output
• Embed keys in client-side code

Link to this sectionKey Rotation#

Rotate keys periodically for security:

1. Create new key with same name
2. Update applications to use new key
3. Verify applications work correctly
4. Revoke old key

Link to this sectionTroubleshooting#

Link to this sectionInvalid Key Error#

Solutions:

1. Verify key is copied correctly (including the ul_ prefix)
2. Check key hasn't been revoked
3. Confirm environment variable is set
4. Ensure you're using ultralytics>=8.4.60

Link to this sectionPermission Denied#

Solutions:

1. Verify you're the resource owner or have appropriate workspace access
2. Check the key belongs to the correct workspace
3. Create a new key if needed

Link to this sectionRate Limited#

Solutions:

1. Reduce request frequency — see the rate limit table for per-endpoint limits
2. Implement exponential backoff using the Retry-After header
3. Use a dedicated endpoint for unlimited inference throughput

Link to this sectionFAQ#

Link to this sectionHow many keys can I create?#

There's no hard limit on API keys. Create as many as needed for different applications and environments.

Link to this sectionDo keys expire?#

Keys don't expire automatically. They remain valid until revoked. Consider implementing rotation for security.

Link to this sectionCan I see my key after creation?#

Yes, full key values are visible in the key list on Settings > API Keys. The Platform decrypts and displays your keys so you can copy them anytime.

Link to this sectionAre keys region-specific?#

Keys work across regions but access data in your account's region only.

Link to this sectionCan I share keys with team members?#

Better practice: Have each team member create their own key. For team workspaces, each member with Editor role or higher can create keys scoped to that workspace.