How to Get a Mistral API Key: Setup, Storage, and First Request

A Mistral API key is a bearer credential. Anything holding it can spend your account's money, which is why the interesting part of this guide is not the four clicks that create the key -- it is where the key lives afterwards and how you diagnose it when requests start failing.

Mistral separates the free experiment tier from paid usage at the workspace level, so check which workspace is selected before you create the key.

Create the Key: Five Steps

1. Sign up. Create an account at console.mistral.ai and complete whatever verification the console requires.
2. Open the API keys screen. In the Mistral La Plateforme console, find the API keys section.
3. Create a key and name it. Name it after the thing that will use it -- prod-api, staging-worker, local-dev. Per-surface keys mean you can revoke one without an outage everywhere else.
4. Copy the secret immediately. It is displayed once. There is no reveal-later button.
5. Store it as MISTRAL_API_KEY in a secret manager or a git-ignored .env file, then verify it before you build anything on top of it.

Verify It With One Request

Do this before writing any application code. A single cURL against the live endpoint separates "the key is wrong" from "my framework is not loading the environment variable" -- two failures that look identical from inside an app.

curl https://api.mistral.ai/v1/chat/completions \
  -H "Authorization: Bearer $MISTRAL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"mistral-large-latest","messages":[{"role":"user","content":"ping"}]}'

A 200 with a completion body means the key is good. Mistral's chat endpoint is OpenAI-compatible, so an existing OpenAI client works once you change the base URL and the key.

Where the Key Should Live

Leaked AI API keys are not a hypothetical. Public repositories and shipped front-end bundles are scraped continuously, and an exposed key on a funded account can burn a serious bill before the first alert fires.

Load the Key Without Leaking It

Most "my key is broken" reports are actually the process never seeing the value. Fail loudly at startup instead of discovering it on the first user request.

const apiKey = process.env.MISTRAL_API_KEY;

if (!apiKey) {
  // Fail at boot, not on the first user request
  throw new Error('MISTRAL_API_KEY is not set');
}

// Safe to log: proves the value loaded without exposing it
console.log('mistral key loaded:', apiKey.slice(0, 4) + '...' + apiKey.slice(-4), 'len', apiKey.length);

export async function callMistral(body) {
  const res = await fetch('https://api.mistral.ai/v1/chat/completions', {
    method: 'POST',
    headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json' },
    body: JSON.stringify(body),
  });

  if (res.status === 401) throw new Error('Mistral: key rejected - check the value, not the network');
  if (res.status === 403) throw new Error('Mistral: key valid but not entitled to this model');
  if (res.status === 429) throw new Error('Mistral: rate limited - back off and retry');
  if (res.status >= 500) throw new Error('Mistral: provider outage - fail over');

  return res.json();
}

Logging the length and the first and last four characters is the fastest way to catch a truncated paste or a trailing newline, and it exposes nothing usable.

Billing: What the Key Can Actually Do

Mistral gates key creation behind phone-number verification. That single step is where most first-time setups stall -- the console will happily show you the API Keys screen and then refuse to mint a key until the number is confirmed.

Set a spend alert the same day you create the key. The failure mode nobody plans for is not an outage -- it is a runaway retry loop or a leaked key quietly spending for a week. Full cost mechanics are in our Mistral API pricing guide.

Key Problem or Mistral Outage? A 60-Second Check

1. Read the status code. 401 and 403 are yours. 429 is quota. 5xx and timeouts are Mistral.
2. Print the key length. A value shorter than expected is a truncated copy, not a revoked key.
3. Try the cURL above. If cURL works and your app does not, the problem is environment loading.
4. Try a second key. If a freshly minted key fails identically, it is not the key.
5. Check status.mistral.ai and live Mistral monitoring before touching anything in production.

The full outage-side playbook is in our Is Mistral Down? guide.

Keep a Second Key Warm

A key that gets revoked, leaked or rate limited is an outage if it is your only path to an LLM. Provisioning a second provider's key on day one costs nothing until you use it.

Frequently Asked Questions

Related Mistral Guides

• Is Mistral Down? Outage Checking Guide
• Mistral API Error Codes Explained
• Mistral API Rate Limits
• Mistral API Pricing Explained
• Mistral API Best Practices
• API Authentication & Security: The Complete Guide