> ## Documentation Index
> Fetch the complete documentation index at: https://docs.humanos.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Credentials for server-to-server integrations with the Humanos API: keys, signature secrets, rotation and expiry.

API Keys authenticate server-to-server integrations with the Humanos API. Each key comes with two secrets that work together:

* the **API Key** itself, sent on every request as a bearer token in the `Authorization` header
* the **Signature Secret**, used to sign each request body so Humanos can verify it wasn't tampered with in transit

Both are required — a request with a valid key but a bad signature is rejected with `401`. The [Authentication](/essentials/authentication) page documents the signing scheme; the [SDK](/essentials/sdk) signs automatically.

## Features

* **Generate**: creates a new key. The secret is shown once at creation, so copy it immediately — it cannot be recovered later, only rotated
* **Rotate**: issues a new secret and immediately invalidates the old one. Rotate on a schedule and whenever a secret may have been exposed (a leaked log, a departed contractor, a compromised CI system)
* **Active**: toggle the key's validity in real time without deleting it, preserving audit history — useful for suspending an integration while investigating
* **Set an expiry date**: the key stops working at that date. Set expiry dates on keys created for temporary work (pilots, migrations, load tests) so they can't outlive their purpose
* **Delete**: permanently removes the key

## Practices worth adopting

* **One key per integration.** A key per service isolates blast radius on rotation and keeps audit trails attributable. [Rate limits](/essentials/rate-limits) are also applied per key, so separate workloads don't compete for the same budget.
* **Store secrets in a secret manager**, not in code or `.env` files committed to a repository.
* **Rotate immediately on any suspicion of exposure** — rotation is instant and the only cost is updating the consuming service.

## Who can manage keys

Members with the **Technical** or **Owner** role can create, rotate and delete API keys (see [Member roles](/dashboard/members)). Managers cannot — key custody is deliberately separated from workflow administration.