> For the complete documentation index, see [llms.txt](https://docs.unitlab.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.unitlab.ai/api-sdk-cli/get-started/authentication-and-configuration.md).

# Authentication and configuration

### Create the credential in Unitlab

![Workspace API key creation entry point](https://292810646-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGjVLUz4wthGkGlRKM6rM%2Fuploads%2F327PnSQHyZTbfbLyJSpN%2Fapi-keys-entry.png?alt=media\&token=dba8de6a-29ac-4957-a68f-74e283028da4)

*Workspace Settings › API keys is the credential issuance surface. Create a key there, copy it directly into an approved secret manager, and never reveal it in documentation, logs, command history, or screenshots.*

{% hint style="info" %}
**Outcome:** Resolve API keys and the API base URL through explicit arguments, environment variables, or CLI configuration.
{% endhint %}

### Credential precedence

`UnitlabClient` resolves configuration in this order:

1. Explicit `api_key` or `api_url` constructor argument.
2. `UNITLAB_API_KEY` or `UNITLAB_API_URL` environment variable.
3. Values written by `unitlab configure`.

If no API key is found, the constructor raises `AuthenticationError` before making a request.

```bash
export UNITLAB_API_KEY="YOUR_API_KEY"
export UNITLAB_API_URL="https://api.unitlab.ai"
```

```python
from unitlab import UnitlabClient

client = UnitlabClient()
try:
    print(client.projects.list())
finally:
    client.close()
```

For a developer workstation, the CLI can persist configuration:

```bash
unitlab configure --api-key "$UNITLAB_API_KEY"
unitlab configure --api-url "https://api.unitlab.ai"
```

Use a workspace-owned service identity where possible. Rotate keys on an explicit schedule and immediately after suspected exposure.

### Operating contract

| Concern           | Required behavior                                                                |
| ----------------- | -------------------------------------------------------------------------------- |
| Execution surface | Pinned `unitlab==3.0.0` application environment on Python 3.10+.                 |
| Identity          | Least-privilege API key supplied through approved configuration.                 |
| Target resolution | Stable resource IDs and an explicitly bounded target set.                        |
| Success evidence  | Typed return fields, server-side state, and downstream acceptance of the result. |

### Failure and recovery boundary

| Condition                                       | Response                                                                                                     |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| Authentication or authorization fails           | Stop, correct the service identity or access model, rotate exposed credentials, and rerun a read-only check. |
| Validation or entitlement rejects the operation | Correct the input or entitlement; do not retry an unchanged request.                                         |
| A request times out                             | Inspect remote state before repeating a mutation because the server may have accepted it.                    |
| Asynchronous processing exceeds its deadline    | Preserve the Batch Queue or release ID, continue bounded monitoring, and inspect item-level failures.        |
| Only part of a batch succeeds                   | Keep successful identifiers, isolate failed rows, and retry only the corrected subset.                       |

{% hint style="warning" %}
Pin and test the production SDK version. Use stable IDs, keep secrets out of logs and command history, and record the correlation ID, target IDs, counts, final state, and redacted error details for material state changes.
{% endhint %}