Creating API Keys

API keys let portfolio websites request your public Nukleio data. Without an API key, a portfolio site cannot access your personal data from the public API.

Create one key for each major integration so you can understand which site or environment is making requests.

When to Create an API Key

Create an API key when you want to connect Nukleio to:

your main portfolio website
a portfolio redesign
a local development version of your portfolio
a resume-focused website
another site that needs your public portfolio data

Using separate keys for separate integrations makes your dashboard activity easier to understand.

Naming API Keys

When creating a key, use a description that identifies where the key will be used.

Good examples:

Main Portfolio
Portfolio Local Development
Portfolio Redesign
Resume Site
Personal Website

Avoid vague names like test, new key, or website if you expect to have more than one key later.

Creating a Key

To create an API key:

Open the API keys area of your dashboard.
Choose the option to create a new key.
Enter a clear description.
Enter an expiration date or leave blank if you never want it to expire.
Create the key.
Copy the key value when it is shown.
Store it securely for your portfolio integration.

Treat the full key as sensitive because it allows a connected client to request your personal portfolio data.

Storing a Key

Store API keys in the safest place your portfolio setup supports.

For most portfolio projects, use an environment variable. Do not hardcode the key throughout the codebase unless you want to expose your personal information to the public.

Example environment variable name:


NUKLEIO_API_KEY=your_api_key_here

Do not commit API keys to a public repository. If a key is exposed, rotate the key in the dashboard, update your portfolio, and remove the exposed key.

Using a Key

A connected portfolio sends the key in the Authorization header as a bearer token.


Authorization: Bearer YOUR_API_KEY

The public API validates the key before returning portfolio data. A client without a valid API key cannot retrieve data.

Monitoring Key Usage

Dashboard analytics can help you understand how API keys are being used.

For example, top connection views can show which keys are making requests most often. Availability and recent activity views can help you identify failed requests or unexpected traffic changes.

Use this information to confirm that your portfolio is connected and that old keys are not still being used.

Rotating or Removing Keys

Rotate or remove a key when:

it was exposed publicly
it belongs to an old portfolio version
you no longer recognize its description
a test integration is finished
you want to separate production and development usage

After removing or replacing a key, update any portfolio site that depended on it. Otherwise, requests from that portfolio will fail authorization.

API Key Checklist

Before connecting your portfolio, confirm that:

the key has a clear description
the full key was copied correctly
the key is stored outside public source code
the portfolio sends it as a bearer token
old or unused keys are removed when no longer needed