API keys

An API key is what your backend uses instead of a dashboard sign-in. Each key belongs to one environment and is for exactly one issuer or one verifier.

Where to manage them

Owners and admins manage keys in Developers → API keys. The page lists the keys for the environment you're in, with the For, Expires, Last used and Created columns.

Sandbox and Production each need their own keys; keys from another environment don't work. To see only one issuer's or verifier's keys, open them from Developers → Overview; the list then shows a For filter you can remove.

Creating a key

Click Create Sandbox key (or Create Production key) and fill in:

Field	What to enter
For	The issuer or verifier the key works for
Name	Something that tells the key apart, such as the system that uses it
Expires	Never, In 90 days or In 1 year

The key is shown once, under Copy your key now. Copy it into your secrets manager before you close the dialog; you can't see it again.

Changing a key

Each key's actions menu has:

Action	What it does
Rename	Changes the name only
Replace key	Creates a new key for the same issuer or verifier. The old key keeps working until you revoke it
Revoke	Stops the key at once

To switch keys without downtime, use Replace key, deploy the new key, then revoke the old one. A key's issuer or verifier can't be changed; create a new key instead.

Using a key

Send the key in the X-API-Key header. Issuer keys look like iss_<keyId>_<secret> and verifier keys like ver_<keyId>_<secret>. See Authentication for client code.