--- title: API Key Authentication Done Right: Lessons from... description: nRouter's API key model shows a key's full value only once, at creation, then displays just its name and last four characters afterward. Keys carry per-key... canonical: https://daily.dev/posts/api-key-authentication-done-right-lessons-from-nrouter-s-shown-once-key-design-pu8yrkbg0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: API Key Authentication Done Right: Lessons from nRouter's Shown-Once Key Design | daily.dev og:description: nRouter's API key model shows a key's full value only once, at creation, then displays just its name and last four characters afterward. Keys carry per-key... og:url: https://daily.dev/posts/api-key-authentication-done-right-lessons-from-nrouter-s-shown-once-key-design-pu8yrkbg0 og:image: https://api.daily.dev/og/posts/PU8yRKbG0.png og:image:alt: API Key Authentication Done Right: Lessons from nRouter's Shown-Once Key Design og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # API Key Authentication Done Right: Lessons from nRouter's Shown-Once Key Design **[C\# Corner](https://daily.dev/sources/csharpcorner)** · 3 min read · 1 upvotes · 0 comments ## Summary nRouter's API key model shows a key's full value only once, at creation, then displays just its name and last four characters afterward. Keys carry per-key budgets, requests-per-minute and tokens-per-minute limits, and every request is logged by the key's alias, making spend and usage traceable per key. Keys are sent as Bearer tokens under RFC 6750 and stored in the NROUTER_API_KEY environment variable, with official Python and TypeScript SDKs resolving it automatically. Revocation is immediate for new requests while in-flight calls finish, and errors are split into 401 for invalid or revoked keys, 403 for insufficient permission, and 429 for rate limit violations. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What HTTP status code should an API return when an API key is revoked versus when it lacks permission? Use 401 when the key is invalid, missing, or revoked, 403 when a valid key lacks permission for the requested action, and 429 when the key exceeds its own rate limit. This separation lets clients distinguish authentication failures from authorization failures and throttling, rather than treating all access errors the same way. _Developers designing API error models can compare real-world patterns like this one on daily.dev._ ### Why would an API only show a generated API key once instead of letting users view it again later in a dashboard? Showing a key only once at creation removes the risk that the secret gets re-displayed at the wrong moment, such as in a screenshot or screen share. After creation, only the key's name and last four characters are shown. If a key is lost, the recommended recovery is to create a new key, move traffic to it, and revoke the old one. _Engineers hardening authentication flows track patterns like shown-once secrets on daily.dev._ ### How should an application store an API key securely instead of hardcoding it in source code? Store the key in an environment variable, such as NROUTER_API_KEY, or in a secrets manager like AWS Secrets Manager or HashiCorp Vault. Never hardcode keys, commit them to version control, share one key across unrelated applications, or log full keys. SDKs can resolve the key automatically from the environment variable. _Developers setting up secret management for new services follow practices like these via daily.dev._ ## Similar posts on daily.dev - [OpenRouter: One API Key to Rule Them All](https://daily.dev/posts/openrouter-one-api-key-to-rule-them-all-ektckqyxv) · Playful Programming · 0 upvotes · 0 comments - [10 Security Issues With API Keys](https://daily.dev/posts/10-security-issues-with-api-keys-bsxna1wno) · Nordic APIs · 0 upvotes · 0 comments - [API Key Security: 7 Enterprise-Proven Methods to Prevent Costly Data Breaches](https://daily.dev/posts/api-key-security-7-enterprise-proven-methods-to-prevent-costly-data-breaches-f1gdbcdrs) · Security Boulevard · 3 upvotes · 0 comments - [JWT Authentication Without the Confusion](https://daily.dev/posts/jwt-authentication-without-the-confusion-tvh5u1id9) · Medium · 1 upvotes · 0 comments - [n8n Security: How Leaked API Keys Expose Your Encryption Key](https://daily.dev/posts/n8n-security-how-leaked-api-keys-expose-your-encryption-key-vmfz5pkzc) · GitGuardian · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/api-key-authentication-done-right-lessons-from-nrouter-s-shown-once-key-design-pu8yrkbg0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"API Key Authentication Done Right: Lessons from nRouter's Shown-Once Key Design","url":"https://daily.dev/posts/api-key-authentication-done-right-lessons-from-nrouter-s-shown-once-key-design-pu8yrkbg0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/api-key-authentication-done-right-lessons-from-nrouter-s-shown-once-key-design-pu8yrkbg0"},"datePublished":"2026-10-28T07:59:30.426Z","dateModified":"2026-10-28T08:14:04.547Z","description":"nRouter's API key model shows a key's full value only once, at creation, then displays just its name and last four characters afterward. Keys carry per-key...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f68cc0bb50c1ed71ee17276e1b7044d1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f68cc0bb50c1ed71ee17276e1b7044d1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"C# Corner","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"C# Corner","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ada2d584df6241748fc4e71878dc70a3","url":"https://daily.dev/sources/csharpcorner"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/api-key-authentication-done-right-lessons-from-nrouter-s-shown-once-key-design-pu8yrkbg0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"C# Corner","item":"https://daily.dev/sources/csharpcorner"},{"@type":"ListItem","position":3,"name":"API Key Authentication Done Right: Lessons from nRouter's Shown-Once Key Design"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/api-key-authentication-done-right-lessons-from-nrouter-s-shown-once-key-design-pu8yrkbg0#faq","mainEntity":[{"@type":"Question","name":"What HTTP status code should an API return when an API key is revoked versus when it lacks permission?","acceptedAnswer":{"@type":"Answer","text":"Use 401 when the key is invalid, missing, or revoked, 403 when a valid key lacks permission for the requested action, and 429 when the key exceeds its own rate limit. This separation lets clients distinguish authentication failures from authorization failures and throttling, rather than treating all access errors the same way. Developers designing API error models can compare real-world patterns like this one on daily.dev."}},{"@type":"Question","name":"Why would an API only show a generated API key once instead of letting users view it again later in a dashboard?","acceptedAnswer":{"@type":"Answer","text":"Showing a key only once at creation removes the risk that the secret gets re-displayed at the wrong moment, such as in a screenshot or screen share. After creation, only the key's name and last four characters are shown. If a key is lost, the recommended recovery is to create a new key, move traffic to it, and revoke the old one. Engineers hardening authentication flows track patterns like shown-once secrets on daily.dev."}},{"@type":"Question","name":"How should an application store an API key securely instead of hardcoding it in source code?","acceptedAnswer":{"@type":"Answer","text":"Store the key in an environment variable, such as NROUTER_API_KEY, or in a secrets manager like AWS Secrets Manager or HashiCorp Vault. Never hardcode keys, commit them to version control, share one key across unrelated applications, or log full keys. SDKs can resolve the key automatically from the environment variable. Developers setting up secret management for new services follow practices like these via daily.dev."}}]} ```