# API keys

Create a named API key on the account desk, copy the secret once, and delete keys you no longer trust.

API keys live at the bottom of `/account`. Give a key a name, press **Create key**, and copy the secret immediately. It is shown once and never again.

## Creating a key

1. Open `/account` and scroll to **API keys**.
2. Type a name. One to eighty characters, after trimming. The button stays disabled until you type something.
3. Press **Create key**.

The new secret appears in a green panel headed **Copy this once**, with a **Copy secret** button next to it. The key also appears at the top of the table below.

The secret has two parts joined by a dot: a public identifier that starts with `ppa_live_`, and the secret itself. Send the whole string as a bearer credential.

> The panel is the only place the full secret exists. Once you navigate away, delete the key and create another. There is no way to recover it.

Creating a key needs an active plan. Without one, the card reads *Choose Peak or Panda to issue a key* and there is no form.

## The key table

Five columns. The section heading counts the active ones.

| Column | What it shows |
| --- | --- |
| Name | The name you gave it |
| Key | The public identifier and the last four characters of the secret |
| Created | The date it was issued |
| Last used | The date of its most recent call, `Never` if unused, `Revoked` if deleted |
| Delete | A two-step control |

Newest keys sit at the top.

## Deleting a key

Press **Delete**. The row swaps to **Delete this key** and **Cancel**, so a single misclick cannot revoke a live credential. Confirm and the key stops working immediately.

A deleted key is not removed from the table. It stays, greyed out, with *Revoked* in the Last used column and no delete control. That way the record of which credential was in use, and when it stopped, survives.

## Scope

Keys belong to you, not to a workspace. The backend resolves the entitlement from the key itself. A browser-supplied actor id or tenancy header cannot grant access, and neither can a client-side flag.

The public API host, credential provisioning and OAuth consent flow are still rollout work and are not deployment verified. Read [authentication](/docs/authentication) before you build against them.

## Related

- [Profile and plan](/docs/profile-and-plan)
- [Usage and limits](/docs/usage-and-limits)
- [Authentication](/docs/authentication)
- [API reference](/docs/api-reference)