Dashboard · Screens

API keys

The keys of this project. Your account key (ak_) is not here — it belongs to the account, opens every project, and lives on the Account screen.

A key is shown once, at creation, then stored hashed: nobody, not even us, can read it back. Lost one? Rotate it — the old one keeps working for 24 hours so you have time to deploy.

The three kinds#

• ak_ — Account key. Opens every project. Never here; it lives in your agent's configuration.
• pk_ — Publishable. Ships in your app's front end. Your agent can create it.
• sk_ — Secret. Server-side only. Created here, by a human — your agent cannot obtain one.

Creating a key#

The panel asks what the key is for (its name, required — it is what tells you which key to revoke later) and its type: Publishable (ships in your app's front end) or Secret (server-side only). The value is shown once.

Every publishable key signs users up, wherever it was created. (Until 2026-09-07 one created by an agent was “inert” and could not; the list showed an inert badge, and the agent read “Key created — but it cannot sign users up”. Both are gone.) See Keys and identities.

Rotating and revoking#

Rotate issues a new value; the old one keeps working 24 hours. Revoke has no grace period, unlike a rotation: anything still using the key gets 401 from the next request on, everywhere. Revoking a key you rotated less than 24 hours ago cuts its previous value too; revoking that previous value (listed as rotating) cuts only it.

The list shows each key's type, status (active, rotating, revoked) and creation date. Last-used dates are not shown.