> ## Documentation Index
> Fetch the complete documentation index at: https://docs.autocampaign.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create and manage API keys so other programs can connect to your Autocampaign AI account.

## Overview

**Not a developer?** This page is for whoever is connecting another program to
your account. An [API key](/getting-started/glossary#api-key) is a password that
lets another program use your account. Create one here, send it to your
developer privately (never by email or chat), and point them to this page. If
they also mention a **webhook**, an **endpoint URL**, a **signing secret**, or a
**payload**, those are explained in plain words on the
[Webhooks](/developers/webhooks) page.

API keys let external systems and [integrations](/getting-started/glossary#integration)
act on your [workspace](/getting-started/glossary#workspace) through the
Autocampaign AI API. Manage them at **Settings → API keys** (`/settings/api-keys`).

<Info>
  **Time to complete:** \~5 minutes  ·  **Difficulty:** Advanced  ·  You need a
  [role](/getting-started/glossary#role) that can manage API keys, and you must be
  signed in as a person — a key can't be used to create other keys.
</Info>

<Warning>
  An API key acts with **Owner-level** permissions for your workspace — anyone with
  the key can do anything an owner can. Store it securely and never save it in
  your code repository (source control).
</Warning>

## Create an API key

<Steps>
  <Step title="Create key">
    Go to **Settings → API keys** and click **Create API key**.
  </Step>

  <Step title="Name it">
    Give it a **Name** (e.g. "Zapier integration"), an optional description, and an
    optional **expiration** (leave blank for a key that never expires).
  </Step>

  <Step title="Copy the secret now">
    The full key (starting with `et_live_`) is shown **once**. Copy and store it
    immediately — you can't see it again.
  </Step>
</Steps>

## Authenticate

Send the key on each request using either header (the part of a request that
carries the key):

```http theme={null}
X-API-Key: et_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

or

```http theme={null}
Authorization: Bearer et_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

## Rotate, revoke, delete

* **Rotate** — generates a new secret (shown once) and immediately stops the old
  one working. Use this if a key may have leaked.
* **Revoke** — stops the key working immediately, keeping its history.
* **Delete** — removes it from the list.

Keys show a status of **active**, **revoked**, or **expired**, plus when they were
last used.

<Note>
  API keys can't manage other API keys or [webhooks](/getting-started/glossary#webhook)
  — those actions require a signed-in user.
</Note>

## FAQ

<AccordionGroup>
  <Accordion title="Can I limit a key to specific permissions?">
    Not today — every key has Owner-level access. Treat keys as highly sensitive and
    rotate them regularly.
  </Accordion>

  <Accordion title="I lost my key — can I see it again?">
    No. The secret is shown only once. Rotate the key to get a new secret.
  </Accordion>

  <Accordion title="How do I use the API?">
    See the [API reference](/api/introduction) for authentication, conventions, and
    available endpoints (the web addresses your program sends requests to).
  </Accordion>
</AccordionGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Requests return 401 Unauthorized">
    Confirm the key is active (not revoked or expired) and sent in the `X-API-Key` or
    `Authorization: Bearer` header exactly as issued.
  </Accordion>
</AccordionGroup>

<Card title="Set up webhooks" icon="webhook" href="/developers/webhooks">
  Get told automatically when something happens in your account.
</Card>