Docs/Getting Started/Authentication

Authentication

Everything that sends data to ANTS Platform authenticates with a project key pair: a public key and a secret key. Data is written to the project that owns the key.

PartFormatNotes
Public keypk-ap-...Identifies the key.
Secret keysk-ap-...The credential. Shown in full only once, when the key is created.
⚠

Treat the secret key like a password. Keep it on the server, out of source control, logs and browser code.

Create a key

  1. Open Project Settings > API Keys.
  2. Select Create API keys.
  3. Copy the Secret Key, Public Key and Host from the sheet. The secret key cannot be shown again.

Among built-in roles, only the Owner can create project keys. Keys expire 6 months after creation. See API Keys for expiry, notes, rotation and the organization keys used for the Admin API.

Use the keys in an SDK

Set environment variables and let the SDK read them:

bash
ANTS_PLATFORM_PUBLIC_KEY=pk-ap-... ANTS_PLATFORM_SECRET_KEY=sk-ap-... ANTS_PLATFORM_HOST=https://<your-ants-host>
python
from ants_platform import AntsPlatform ants = AntsPlatform() # reads the variables above

Or pass them explicitly:

python
ants = AntsPlatform( public_key="pk-ap-...", secret_key=load_secret("ants-secret-key"), host="https://<your-ants-host>", )

If either key is missing, the client logs a warning and sends nothing.

ℹ

Always set the host. Both SDKs default to https://api.agenticants.ai, which may not be your deployment. Use the Host value shown when you create the key, or ask your administrator.

Use the keys over HTTP

OpenTelemetry exporters and direct API calls use HTTP Basic authentication: the public key is the username and the secret key is the password.

bash
# Base64 of "public:secret" AUTH=$(printf '%s' "pk-ap-...:sk-ap-..." | base64) # OpenTelemetry exporters export OTEL_EXPORTER_OTLP_ENDPOINT="https://<your-ants-host>/api/public/otel" export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Basic ${AUTH}" # REST API curl -u "pk-ap-...:sk-ap-..." "https://<your-ants-host>/api/public/projects"

See OpenTelemetry (OTLP) and API Authentication.

Store keys safely

Load the secret key from your platform's secret store into the environment variables above.

bash
kubectl create secret generic ants-platform \ --from-literal=ANTS_PLATFORM_PUBLIC_KEY=pk-ap-... \ --from-literal=ANTS_PLATFORM_SECRET_KEY=sk-ap-...
yaml
containers: - name: app envFrom: - secretRef: name: ants-platform env: - name: ANTS_PLATFORM_HOST value: https://<your-ants-host>

Good practice:

  • Use a separate project, and so separate keys, per environment or team.
  • Add a note to each key saying which service uses it.
  • Never ship the secret key in a browser or mobile app.

Rotate a key

There is no rotate button. Create a new key, roll it out to your services, then delete the old key. A deleted key stops working within a few minutes. Plan rotations before the 6-month expiry; Owners are notified ahead of time. See API Keys.

Test your keys

python
from ants_platform import AntsPlatform print(AntsPlatform().auth_check()) # True, or raises with the reason

Troubleshooting

ResponseCause
401Wrong or expired key, keys from different pairs, or extra whitespace. Organization keys and public-key-only (Bearer) requests are also refused on ingestion endpoints.
402Ingestion is blocked for billing reasons. See Credit System.
403 on read requestsThe deployment limits project keys to sending data. Ingestion still works.
429Rate limit reached. Retry with backoff.
No error, no dataWrong host. Check ANTS_PLATFORM_HOST (Python) or ANTS_PLATFORM_BASE_URL (JS/TS).

Next steps

© 2026 ANTS Platform, Inc.Docs v1.0 · Last updated June 2026