How to Create a Vast.ai API Key (and Keep It Safe)

What a Vast.ai API key actually does

The key authenticates programmatic access to your Vast.ai account. With it, a tool or script can do through the API what you do in the browser: list your machines and their status, read marketplace offers, and update listing settings such as prices. This is what makes automation possible at all. The Vast.ai CLI uses it, custom host scripts use it, and pricing tools like GPU Autopilot use it.

The flip side is obvious: the key is a bearer credential. Whoever presents it is you, as far as the API is concerned. There is no second factor on an API call, no confirmation prompt, and no way for the platform to tell your automation from an attacker holding a leaked key. That is why the rest of this guide is about containment: creating the key is the easy part, and everything after is making sure only the right software ever sees it.

Create the key in account settings

1. 1Sign in at vast.ai with your hosting account.
2. 2Open the account settings page. The API key section lives with your other account credentials.
3. 3Create a key. Where Vast.ai offers scoping options, grant only what the consumer of the key needs, and prefer a dedicated key per tool over one master key shared by everything.
4. 4Copy the key and store it in a password manager immediately. Treat the value like a password, because it is one.

Security rules that are not optional

• Never commit it. Not in a script, not in a config file, not in a "private" repo that becomes public later. Scanners find leaked keys in public commits within minutes. Load it from an environment variable or a secrets file excluded from version control instead.
• Never share it publicly. No screenshots with the key visible, no pasting it into Discord when asking for help, no sending it over email. Legitimate support will never need your actual key.
• Rotate on suspicion. If a key may have leaked, generate a new one and revoke the old one from the same settings page, then update the tools that used it. Rotation is cheap; cleaning up after a hijacked account is not.
• Only hand it to services you trust. Before pasting your key into any third-party tool, know how it stores the key and what it does with it. If a service cannot answer that, walk away.

The same mindset applies to the machine itself. A host box with password SSH logins open to the internet undermines every credential on it; see SSH security for GPU hosts for the companion checklist.

How GPU Autopilot handles your key

Since GPU Autopilot is one of the services asking for this key, it should answer its own questions. The key you add is encrypted at rest, and it is used for exactly three things: reading your machine status, reading marketplace data, and updating your listing prices within the bounds you configure. It is never used to create, delete, or otherwise modify machines, nothing is installed on your hardware, and the key is not shown back to you in plain text after setup. You can remove it, or delete your whole account, from Settings at any time.

Test it, then put it to work

A quick sanity check after creating a key: point one tool at it and confirm your machines appear. If your machine list comes back, the key works, and if it ever stops working you will see failed calls rather than silence, so check the key first whenever an integration goes quiet. In GPU Autopilot that shows up as Failed entries in the Activity feed, which makes a dead or rotated key obvious within a few minutes instead of a few days. Keys can also be invalidated on the Vast.ai side when you rotate them, so after any rotation, update every tool that held the old value the same day.

With a working key in your password manager, the next step takes about three minutes: connect it and turn pricing over to the agent in the GPU Autopilot quick start.