"Llama API key" is a high-volume search term, but it does not correspond to a single product. On July 6, 2026, Meta's Llama API public preview was retired. To keep using Llama today, you generally go through a cloud provider, an inference platform, a self-hosted deployment, or an OpenAI-compatible gateway. Each route issues a different credential: some are bearer tokens, some are temporary signed credentials tied to a cloud account, and some need no key at all.

This article explains, route by route, where the key comes from, how to scope permissions, where to put environment variables, how to debug a 401, and how to rotate after a leak. Model availability and billing rules follow the model pricing page.

Note: Meta and Llama are trademarks of Meta Platforms, Inc.; other platform and model names are trademarks of their respective owners. This article is a technical explainer only and implies no affiliation, agency, or endorsement with Meta or the platforms mentioned.

1. First, the four kinds of "Llama API key"

Route Credential form Where to create it Best for
Cloud-hosted IAM role, temporary credentials, or resource key AWS IAM, Microsoft Foundry, Google Cloud console Teams with an existing cloud contract that need audit trails and regional compliance
Inference platform Bearer API key Groq, OpenRouter, and similar consoles Fast integration without GPU operations
Self-hosted inference Your own authentication, or none on a private network vLLM, Ollama, llama.cpp Strict data boundaries and available GPUs
Compatible gateway Gateway API key Gateway console One entry point for many models, local-currency billing

The same phrase means different things on different platforms. A cloud IAM credential cannot be pasted into the api_key field of an OpenAI SDK, and an inference platform's key usually cannot call another vendor's models. Confirm the credential type before discussing how to "get" one.

2. The official route: Meta's Llama API key is history

Meta launched the Llama API public preview in 2025, offering a hosted entry point at api.llama.com and an OpenAI-compatible path. That preview was retired on July 6, 2026. Old requests receive a service-termination notice or a redirect hint, and old keys generally no longer work. When you see a tutorial telling you to "create a Llama API key in the Meta console," check its publication date first.

Two things need separating: model weights and the hosted API. Llama's open weights are still available under the Llama Community License from Meta's model pages and Hugging Face. What shut down is Meta's first-party hosting layer. Meta's current Meta Model API offers the Muse family, not Llama; do not conflate the two.

So "official key" today has only two meanings. One is downloading the weights from official channels and self-hosting with your own authentication. The other is calling Llama through a cloud provider or hosting service. Any third-party page claiming it can issue an "official Meta Llama API key" should be verified before you trust it.

3. Cloud providers: you get an IAM credential, not a paste-in key

AWS Bedrock. First request model access in the console, then grant the caller least-privilege permissions such as bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream. Calls use SigV4 signing, usually handled by the SDK or temporary credentials, so a long-lived key does not belong in code. For Llama 4 Scout, for example, Bedrock currently supports only the Invoke or Converse API and does not offer a Chat Completions entry point. The model ID looks like meta.llama4-scout-17b-instruct-v1:0, cross-region inference adds a prefix such as us., and availability varies by region and lifecycle stage.

Microsoft Foundry (formerly Azure AI Foundry). After deploying a Llama model from the model catalog, use the resource endpoint plus a key, or switch to Entra ID identity. The key is bound to the resource; changing subscription or region requires rechecking it.

Google Cloud Vertex AI. Call through a service account or application default credentials, grant the account the relevant Vertex AI roles, and confirm the project, region, and model version. Watch lifecycle: Google has announced that llama-3.3-70b-instruct-maas retires on October 21, 2026, so teams still using it need to migrate or self-host.

The common traits of the cloud route are fine-grained permissions and a complete audit chain, at the cost of slow onboarding and many billing line items. Do not hand a key to an individual. Bind it to a workload identity, and restrict source networks and allowed regions.

4. Inference platforms and compatible gateways: the usual bearer key

Inference platforms such as Groq, OpenRouter, and Fireworks, along with OpenAI-compatible gateways, usually provide a console where you create a bearer token on the API Keys page. The steps are broadly the same:

  1. Register an account and complete email, phone, or business verification as the platform requires.
  2. Open the API Keys page, create a key, and name it clearly by project, environment, and owner, for example prod-rag-cn.
  3. Grant least privilege: inference only, not billing, member management, or key management.
  4. Set a budget, rate, or monthly cap so a single key cannot drain the account.
  5. Copy it straight into a password manager or secret service. Most platforms show it only once.
  6. Validate the key, base URL, and model name with a minimal request before writing the real configuration.

The difference with gateways is that one key may map to several upstream models. On ZSQH AI Gateway, for example, the base URL is https://ai.zhongshangqihang.com/v1; the models actually available are governed by the console and the model pricing page. The benefit is unified billing and logs. The cost is an extra forwarding layer, so confirm the data path, failure handling, and billing rules when choosing.

5. Permissions: a key should not be all-powerful

Treat a key as an identity, not a password. Use separate keys for production, testing, and personal experiments. Never ship a long-lived key in a frontend, mobile app, or public repository. When a browser must connect directly, use short-lived tokens or a backend proxy. Add every restriction a platform offers: IP allowlists, origin domains, model scopes, and budget caps.

The common anti-pattern on teams is "one key for everyone." When something goes wrong, you cannot tell who made the call. After a leak, you cannot revoke just one person. Split keys by project and pair them with usage tags and alerts; debugging becomes much cheaper.

6. Environment variables and code: keep the key out of Git

# Keep .env on the local machine or in a secret service; never commit it to Git
export LLAMA_API_KEY="your-key"
export LLAMA_BASE_URL="https://api.groq.com/openai/v1"
export LLAMA_MODEL="llama-3.3-70b-versatile"

SDKs for Python, Node, and other languages often read OPENAI_API_KEY when no argument is passed explicitly. If the same process calls other vendors too, pass api_key explicitly so you do not send platform A's key to platform B. For containers and systemd services, confirm the variable is actually injected rather than only set in the current shell.

For a 401, check in this order:

  • Is the header Authorization: Bearer <key>, with one space after Bearer?
  • Does the key belong to the platform behind the current base URL? Cross-platform keys do not work.
  • Was the key revoked, expired, or never enabled after creation?
  • Did the environment variable pick up quotes, newlines, or stray spaces from copying?
  • Is the service process still reading an old variable, and was it restarted after the change?
  • A 401 means authentication failed; a 403 usually means authentication passed but permission is insufficient. Do not conflate them.

7. Rotation and revocation: design the exit path first

  1. Create a new key on the platform and include a date in the name, for example prod-2026-10.
  2. Swap it into one test service or canary instance first, watching 401s, 403s, and latency.
  3. Confirm the logs show no authentication failures, then roll it out to the remaining environments.
  4. Keep old and new keys overlapping for a while, but no longer than one release cycle.
  5. Revoke the old key once it has no traffic, and check recent usage for anomalies.
  6. Update the key register: creation time, owner, purpose, next rotation date.

Events that should trigger rotation include staff departures, a key appearing in logs or a repository, a vendor security incident, and scheduled periodic rotation. If you suspect a leak, revoke first and investigate second; do not start by changing code. Check the bill and call logs at the same time for requests to unexpected models or regions.

Frequently asked questions

Can I still apply for an official Meta Llama API key?

No. Meta's Llama API public preview was retired on July 6, 2026, and the old entry point no longer serves inference. Llama weights can still be downloaded; hosted calls go through cloud providers, inference platforms, or compatible gateways.

Why don't cloud providers offer a key I can just paste?

Cloud providers usually authenticate with IAM roles, service accounts, or temporary credentials, with permissions and audit tied to the cloud account. That is more granular than a long-lived bearer token, but integration requires configuring permissions and signing first. You cannot simply reuse the OpenAI SDK's api_key parameter.

Can one key call every Llama model?

It depends on the platform. Inference platforms and gateways usually let one key call the models enabled on the account. Cloud providers are constrained by IAM permissions, model access requests, and regions. Whether a model is available is governed by the console's current list.

What happens if the key is placed in a frontend or app?

It is effectively public. Anyone can capture it and spend your quota. Browsers and mobile apps should call your own backend, which holds the key and handles authentication, quotas, and logging.

For 401 versus 403, what should I check first?

For 401, check the key itself, the header format, and whether the base URL matches. For 403, check whether that key or role has permission for the target model, project, or region. After both, check the gateway or cloud provider status page.

Next steps

Choose the integration route first, then create a dedicated key. Use IAM on cloud providers, bearer tokens on inference platforms and gateways, and your own authentication when self-hosting. If you need unified keys, logs, and a multi-model entry point, start by signing up for ZSQH AI Gateway. Model availability and billing rules are governed by the model pricing page.

Related reading: