API keys - Mistral AI

2026-04-17 · Source: mistral.ai via Google News · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Software Development & Engineering, Cybersecurity & Data Privacy · Depth: Intermediate, quick

Summary

Mistral API keys are essential for authenticating requests to the Mistral API, with each key specifically scoped to a Workspace and granting access to all API endpoints available under the user's plan. Users can create new keys via the Studio interface, optionally assigning a name and an expiration date. Once generated, the full key is displayed only once and must be copied and stored securely, as it cannot be retrieved later. Keys are passed in the `Authorization` header for `curl` requests or set as an environment variable for SDKs. All resources created with a key are visible to members of its associated Workspace, and separate Workspaces are recommended for different environments like development or production. Key management practices include regular rotation, immediate revocation of compromised keys, and setting expiration dates. API key usage is tracked and billed to the Organization, requiring activated payments through either the free Experiment tier or the pay-as-you-go Scale plan.

Key takeaway

For AI Engineers integrating with the Mistral API, securely managing your API keys is paramount. Always copy the full key immediately upon creation and store it in a secrets vault, never in version control. Implement a strategy for regular key rotation and utilize expiration dates to minimize security risks. If a key is compromised, revoke it without delay to protect your Workspace resources.

Key insights

Mistral API keys authenticate requests, are Workspace-scoped, and require secure handling and regular management.

Principles

• API keys are Workspace-specific.
• Keys must be stored securely.
• Regular key rotation is critical.

Method

Create a new key in Studio, copy it immediately, and pass it via the `Authorization` header or as an environment variable for API access.

In practice

• Use separate Workspaces for environments.
• Set expiration dates for all keys.
• Revoke compromised keys instantly.

Topics

• API Keys
• Mistral API
• API Authentication
• Workspace Scoping
• Key Management

Best for: AI Engineer, Machine Learning Engineer, Software Engineer

Related on AIssential

• Activate Studio and generate an API key - Mistral AI — Securely generate and manage Mistral API keys for free access to their AI models.
• Google API Keys Weren't Secrets. But then Gemini Changed the Rules. — Shared API key infrastructure between public and private services creates critical privilege escalation risks.
• Security advisories | Mistral Docs - Mistral AI — A supply chain attack compromised Mistral AI's SDK packages, with PyPI versions posing a credential harvesting risk.
• Vercel breach prompts crypto projects to rotate API keys — A Vercel security breach via Context.ai compromised API keys, impacting crypto projects and raising concerns for Web3 infrastructure.
• scan-for-secrets 0.1 — The `scan-for-secrets` tool prevents accidental secret exposure by scanning files for literal and encoded keys.
• Secrets and Tokens Are Not Configuration. They Are a System — Access credentials form an interconnected system that defines platform behavior, not just isolated configuration.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by mistral.ai via Google News.