Concepts

Core Concepts

Core Concepts

Static API Key Credentials

CredentialServiceType.StaticKey is a simpler credential type for services that authenticate with one static API key. Supply the key via WithServiceKey, WithKeyFromEnv, or WithKeyFromApi. FetchAccessToken hands it back unchanged with no login step.

A Credential Type With No Login Step

Every other CredentialServiceType involves a login of some kind -- a password manager vault, or an OAuth flow for Google, Azure, or AWS. StaticKey is different: there is nothing to log into. The credential is just the API key itself, and FetchAccessToken for StaticKey returns that key as-is as the access token -- no network call, no token exchange, nothing that can fail except a missing key.

ICredentials creds = GPAL.CredentialsFor(CredentialServiceType.StaticKey)

.WithServiceKey("sk-ant-api03-...")

.ToGPALObject();

WithKeyFromEnv: Keeping Keys Out of Source Code

WithKeyFromEnv(envVariableName) is an alternative to WithServiceKey that reads the key from an environment variable instead of a literal string. Checking the process environment first, then the current user's environment, then the machine's. If the variable isn't set anywhere, GPAL publishes an ERROR event (see The Event System) and the credentials are left without a key. This keeps API keys out of source control entirely: set the environment variable once on the machine running the workflow, and reference it by name in code that can be committed safely.

// Reads the ANTKEY environment variable (process, then user, then machine scope)

ICredentials creds = GPAL.CredentialsFor(CredentialServiceType.StaticKey)

.WithKeyFromEnv("ANTKEY")

.ToGPALObject();

WithKeyFromApi: Fetching the Key from an Internal Endpoint

WithKeyFromApi supplies an already-configured RESTClient and must be followed by WithEndpoint to name the endpoint that returns the key. GPAL makes a GET request and uses the response body as the key. Use this when the key is stored securely in an internal service rather than in the environment.

IRESTClient keyStore = GPAL.RESTClient

.WithAPIBase("http://localhost:3000/")

.ToGPALObject();

ICredentials creds = GPAL.CredentialsFor(CredentialServiceType.StaticKey)

.WithKeyFromApi(keyStore)

.WithEndpoint("ANTKEY")

.ToGPALObject();

WARNING

Supplying an xAI key while using AIProviderType.OpenAI will compile and run. The mismatch only surfaces as an authentication error at request time. Make sure the key and the provider configured on GPAL.AI.WithProvider match.

On this page

Core Concepts
Static API Key Credentials
  • A Credential Type With No Login Step
  • WithKeyFromEnv: Keeping Keys Out of Source Code
  • WithKeyFromApi: Fetching the Key from an Internal Endpoint