Replicate Authentication: API Key Setup and Security (2026)

Authentication overview

Replicate's API authentication system is designed to secure access to its model hosting and inference services. All interactions with the Replicate API, including running predictions, managing models, and accessing account information, require authentication. The primary method for authenticating requests is through the use of API tokens, which function as bearer tokens.

When an authenticated request is made, the Replicate API verifies the provided token against its records. If the token is valid and associated with an active user account, the request is processed according to the permissions granted to that user. This mechanism ensures that only authorized entities can interact with models deployed on the Replicate platform and helps maintain the integrity and security of user data and computational resources. Replicate's API endpoints are served exclusively over HTTPS, encrypting all data in transit to prevent interception and tampering, aligning with industry standards for secure API communication as detailed by the IETF's HTTP over TLS specification.

Supported authentication methods

Replicate primarily supports a single, consistent authentication method across its API and SDKs:

An API token is a unique, secret string that identifies your Replicate account. When you make an API request, this token is included in the Authorization header as a Bearer token. This method is a common practice for securing RESTful APIs, providing a straightforward way to authenticate requests without sending user credentials (like username and password) with every interaction. For instance, Stripe's API also utilizes secret API keys for authentication, demonstrating the widespread adoption of this model.

Getting your credentials

To interact with the Replicate API, you need to generate an API token from your Replicate account settings. Follow these steps to obtain your credentials:

1. Log in to Replicate: Navigate to the Replicate homepage and log in to your account. If you don't have an account, you will need to sign up first.
2. Access API Tokens: Once logged in, go to your API Tokens page. This page lists any existing tokens and provides options to create new ones.
3. Generate a New Token: Click on the "Add new token" or similar button. Replicate will generate a new, unique API token for your account.
4. Copy Your Token: Immediately copy the generated token. For security reasons, Replicate typically only displays the full token once at the time of creation. If you lose it, you may need to generate a new one.
5. Store Securely: Store your API token in a secure location. It is recommended to store it as an environment variable rather than hardcoding it directly into your application code. This practice minimizes the risk of accidental exposure.

Once you have your token, you can configure your environment or application to use it. Replicate's SDKs and CLI tools are designed to automatically pick up the token if it's set as an environment variable named REPLICATE_API_TOKEN.

Authenticated request example

This example demonstrates how to make an authenticated request to the Replicate API using the Python SDK. It assumes you have already obtained your API token and set it as an environment variable.

Python SDK Example

First, ensure you have the Replicate Python client library installed:

pip install replicate

Then, set your API token as an environment variable:

export REPLICATE_API_TOKEN="r8_YOUR_API_TOKEN_HERE"

Now, you can use the SDK to make an authenticated request to run a model:

import os
import replicate

# The SDK automatically picks up REPLICATE_API_TOKEN from environment variables
# No explicit token passing is needed if the environment variable is set.

# Example: Run a text-to-image model
model_output = replicate.run(
    "stability-ai/stable-diffusion:db21e45d3f7023abc2a46ee38221c96df1e286dd461a97d0c0a9e1d206824ad6",
    input={"prompt": "a photo of an astronaut riding a horse on mars"}
)

print("Generated image URL:", model_output[0])

Raw HTTP Request Example

If you are not using an SDK, you can make a direct HTTP request using tools like curl. Remember to replace r8_YOUR_API_TOKEN_HERE with your actual Replicate API token.

curl -X POST \
  -H "Authorization: Token r8_YOUR_API_TOKEN_HERE" \
  -H "Content-Type: application/json" \
  -d '{ "version": "db21e45d3f7023abc2a46ee38221c96df1e286dd461a97d0c0a9e1d206824ad6", "input": { "prompt": "a photo of an astronaut riding a horse on mars" } }' \
  https://api.replicate.com/v1/predictions

In both examples, the API token is included in the Authorization header with the Token scheme, as specified by the Replicate HTTP API reference.

Security best practices

Managing API tokens securely is critical to prevent unauthorized access to your Replicate account and resources. Adhere to these best practices:

• Environment Variables: Always store your API token as an environment variable (e.g., REPLICATE_API_TOKEN) rather than hardcoding it directly into your source code. This practice prevents the token from being exposed in version control systems like Git or accidentally shared.
• Access Control: Restrict access to systems and environments where API tokens are stored. Implement strong access controls, such as multi-factor authentication (MFA) for user accounts that can access these environments.
• Regular Rotation: Periodically rotate your API tokens. If a token is compromised, rotating it ensures that the compromised token quickly becomes invalid, limiting the window of exposure.
• Least Privilege: While Replicate API tokens currently grant broad access to your account, always apply the principle of least privilege in your overall system design. If you are building an application, ensure that other components only have the minimum necessary permissions.
• Secure Communication (HTTPS/TLS): All communication with the Replicate API occurs over HTTPS/TLS, which encrypts data in transit. Ensure that your application or client is configured to enforce HTTPS and validate SSL certificates to prevent man-in-the-middle attacks.
• Error Handling and Logging: Implement robust error handling and logging. Avoid logging API tokens or sensitive request details in plaintext. Mask or redact tokens from all logs.
• Avoid Public Repositories: Never commit API tokens or configuration files containing tokens to public code repositories. Use .gitignore files to exclude such files from being uploaded.
• Client-Side Usage (Caution): Exercise extreme caution if using API tokens directly in client-side (browser-based) applications. While possible, this greatly increases the risk of token exposure to end-users or malicious actors. For client-side applications, consider using a backend proxy that authenticates with Replicate on behalf of the client, or explore temporary, scoped tokens if Replicate introduces such capabilities in the future.
• Monitor for Anomalies: Regularly monitor your Replicate account activity for any unusual or unauthorized usage patterns that might indicate a compromised token.

By following these guidelines, developers can significantly reduce the risk of API token compromise and maintain the security of their applications interacting with Replicate.