Generate and Secure Your API Key

The credential that authenticates your requests

Your API key authenticates every request sent to Mistral models: without it, no call is accepted. Think of it as a technical password, except it travels through code, configuration files, and deployment pipelines, meaning it ends up in far more places than a standard password. Anyone who has it can consume your quota and generate costs on your account.

Generate your first key

In the Mistral Console, open your workspace and navigate to the API Keys section in the sidebar. Click Create new key and give it a descriptive name, such as dev-chatbot-mars-2026. This name has no technical function, but it will save you the day six keys coexist in the list and you need to revoke just one: “key 3” tells you nothing, while dev-chatbot-mars-2026 tells you everything.

The key displays only once, at the moment of creation. Copy it immediately and store it in a safe place. If you close the window before copying it, there is no way to recover it: you must generate a new one. A Mistral key consists of a prefix followed by a long alphanumeric string. Do not confuse it with your workspace ID or a JWT token: unlike the latter, it does not expire on its own and remains valid until you revoke it.

Store it without ever hardcoding it

The golden rule is simple: never hardcode your API key in source code. The day that file lands in a shared repository, the key goes with it. Always use an environment variable instead.

On Linux and macOS, declare it in the terminal:

export MISTRAL_API_KEY="your-api-key-here"

This variable disappears when you close the terminal; to make it persistent, add the line to your ~/.bashrc, ~/.zshrc, or ~/.profile file.

On Windows, the PowerShell equivalent looks like this:

$env:MISTRAL_API_KEY = "your-api-key-here"

And to survive a session restart:

[System.Environment]::SetEnvironmentVariable("MISTRAL_API_KEY", "your-api-key-here", "User")

In an application project, the most common practice is to create a .env file at the root:

MISTRAL_API_KEY=your-api-key-here

Add .env to your .gitignore immediately—before your first commit, not after. In Python, the python-dotenv library reads this file and injects the variables at startup, giving you the convenience of a local file without the risk of versioning secrets.

Rotate your keys

Replace a key for three reasons. Immediately, if it has been exposed in any way: a commit pushed to a public Git repository, a hasty Slack message, or traces in server logs. Regularly in production, with every ninety days being a reasonable cadence. And when a collaborator leaves who had access, on the same day they return their badge.

The procedure avoids service interruption if you respect the order:

1. Generate a new key in the Console
2. Update the environment variable in all your deployments
3. Verify that everything works with the new key
4. Revoke the old key only after this verification

Swapping steps 3 and 4 is the classic mistake: you revoke first “to be safe,” only to discover a forgotten service was still using the old key. This zero-downtime rotation ensures no component fails during the transition.

Reduce the exposure surface

If multiple applications call the API, create one key per application. If one is compromised, you only need to revoke that specific key without stopping the others. On the same principle, never reuse a production key in development: that is precisely the environment where secrets circulate most freely.

Next, monitor usage from the Console, which exposes usage logs for each key. A sudden spike in tokens or calls from an unknown IP address should trigger immediate rotation, without waiting for incident confirmation.

Three final errors deserve mention because we encounter them every week. A key published to a public Git repository remains readable in the history even after the file is deleted: the only valid response is revocation. A key sent in clear text via email or instant messaging is archived forever on servers you do not control. And an expired or revoked key lingering in a deployment produces 401 Unauthorized errors that often take an hour to diagnose simply because no one thought to check.

Key takeaways

• Generate your keys from the API Keys section of your workspace in the Mistral Console
• Store them exclusively in environment variables or a secrets manager
• Perform regular rotation and immediate rotation in case of exposure
• Create one key per application to limit the impact of a compromise
• Always add .env to your .gitignore