Perplexity API Key: How to Create, Use, Rotate and Secure It
A Perplexity API key authenticates requests from your application and attributes usage to your API group. Follow the current Console process, copy the token while it is visible, keep it on the server and rotate it without interrupting production.
Fact checked against Perplexity’s official developer documentation in August 2026. Console labels and account requirements can change.
pplx-••••••••••••••••••••••••What is a Perplexity API key?
A Perplexity API key is a secret credential used to authenticate calls to the Perplexity developer platform. Your server sends it as a Bearer token, allowing Perplexity to associate the request with an API group, check access and attribute usage.
The key is not the same as a Perplexity password, a consumer subscription or a key for another model provider. One Perplexity key can be used with the supported Perplexity API products available to your group, but each application and environment should normally have its own identifiable credential.
What you need before creating a Perplexity API key
Signing in creates or reuses a Perplexity account, but it does not create an API project by itself. The API group is the required workspace for keys, members, usage and billing.
Perplexity account
Access the API Portal with Google, Apple, eligible organisational SSO or a passwordless email link and code.
API group
Create a group or accept an invitation to an existing group. The group controls API keys, usage, billing and optional team access.
Suitable permission
Perplexity lists admin permission as a prerequisite for billing and key management. Members can view usage and limits but cannot change settings.
How to get a Perplexity API key
Create the first key through the web interface. After that, Perplexity also provides authenticated endpoints for generating and revoking additional keys programmatically.
Open the API Console
Go to console.perplexity.ai and sign in with the account that should own or join the API group.
Create or select an API group
Follow the setup wizard, complete the group details and confirm that you are working inside the correct organisation or project.
Open API keys
In the left sidebar under Group, choose API keys. Select + Generate API Key to start.
Give the key a descriptive name
Use a name such as Production-Research-App, Staging-SEO-Tool or CI-CD-Tests. The name becomes important after the secret itself is hidden.
Copy and store the token
Save the full value immediately in an approved password or secrets manager. Perplexity says it cannot be retrieved again after the creation screen or response is closed.
How to use a Perplexity API key
Store the key as an environment variable and let the official SDK read it, or send it in the HTTP Authorization header from trusted server-side code.
export PERPLEXITY_API_KEY="your_key_from_the_console"
python your_app.pyFor a persistent deployment, configure the secret through your host or deployment platform instead of putting it in shell history.
curl https://api.perplexity.ai/v1/agent \
-H "Authorization: Bearer $PERPLEXITY_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"preset": "fast",
"input": "Test request"
}'The environment variable expands locally; the secret should not appear in the script committed to source control.
Where to store your Perplexity API key safely
The right location depends on the environment, but the principle is consistent: keep the key outside published code and expose it only to the service that needs it.
Local development
Use a local environment file that is excluded by .gitignore, or an operating-system secret store. Never commit the real file.
Hosted application
Use the environment-variable or secret-management interface supplied by the host, container platform or cloud provider.
CI/CD pipeline
Add the token as a masked repository or organisation secret and restrict which workflows, branches and maintainers can use it.
WordPress integration
Keep it in a server-side environment variable or protected configuration, then read it only inside trusted PHP. Never render it into Elementor or page source.
How many API keys should you create?
Use separate, descriptively named keys when independent applications, environments or owners need distinct deployment and revocation paths.
How to rotate a Perplexity API key without downtime
Do not revoke the working key first. Create and deploy the replacement, verify every service, then remove the old credential.
Generate
Create a new, descriptively named key while the current production key remains active.
Deploy
Update the secret in every relevant host, container, worker and scheduled job.
Verify
Send a small authenticated request and monitor until all instances use the replacement.
Revoke
Revoke the old key only after confirming the rollout. Revoked keys cannot be recovered.
What to do if a Perplexity API key is exposed
Treat a public commit, screenshot, support ticket, log entry or browser bundle as a compromise. Removing the visible copy is not enough because someone may already have saved it.
Immediate response sequence
Managing API keys in SEO and outreach tools
Whether the application monitors search news, checks sources or prepares publisher research, the key should remain behind your own access and usage controls.
Public SEO tool
Send user input to a rate-limited backend. Never allow the browser to call Perplexity with the site owner’s secret.
Scheduled research job
Give the worker its own key so it can be paused, rotated or revoked without disrupting the website or another application.
Team research workflow
Keep credentials under group administration. Share access to the application, not copies of a raw key through chat or email.
Why a Perplexity API key is not working
An authentication error can come from the key, header, group credit or deployment—not only from a copied character.
Invalid or deleted key
Confirm that the environment variable contains the current token and that the key was not revoked during rotation.
API group has no credit
Perplexity notes that a 401 can also occur when the associated account has run out of API credit. Check the API billing page.
Variable is not loaded
Restart the process after changing deployment secrets and confirm the variable name is exactly PERPLEXITY_API_KEY.
Bearer header is malformed
Use Authorization: Bearer $PERPLEXITY_API_KEY. Do not put the key in a URL parameter or invent a different header.
Some instances use the old key
Check background workers, serverless functions, containers and scheduled jobs before completing revocation.
The key works, but rate limits apply
A 429 is not an authentication failure. Respect the retry interval and apply exponential backoff with jitter.
Perplexity API key questions
Direct answers about retrieval, subscriptions, sharing, rotation and exposed credentials.
Where do I get a Perplexity API key?
Sign in at console.perplexity.ai, create or join an API group, open API keys in the Group sidebar and select + Generate API Key.
Can I view my Perplexity API key again?
No. Perplexity says the full token is displayed only when it is created and cannot be retrieved later from the Console or an endpoint. If it was not saved, generate a replacement and revoke the unused key.
Do I need Perplexity Pro for an API key?
No. API access has separate groups, keys, credit and usage-based billing. A consumer subscription does not include unlimited API calls.
Can I put the API key in JavaScript?
Not in JavaScript delivered to a user’s browser. Public client code can be inspected. Keep the key on your server and have the client call a protected backend endpoint.
How often should I rotate the key?
Perplexity recommends regular rotation and uses 90 days as an example. Follow the schedule required by your organisation’s risk and compliance policy, and rotate immediately after suspected exposure.
Can I use one key for several applications?
It may work technically, but separate keys make ownership, attribution, deployment and revocation clearer. Avoid sharing one production credential across unrelated applications and environments.
Create the key once—manage it for its entire lifecycle
Secure API access is not finished when the first request succeeds. Name the credential clearly, store it server-side, monitor its use, rotate it safely and revoke it immediately when exposure is suspected.
