> ## Documentation Index
> Fetch the complete documentation index at: https://docs.yativo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Create, manage and revoke the API keys your servers use to call Yativo

An API key lets your servers call the Yativo API without signing in. It's a pair of values sent as headers on every request:

| Value | Header | Format | Visible later |
| - | - | - | - |
| API key | `X-Api-Key` | `yativo_pk_...` | Yes, in the dashboard |
| API secret | `X-Api-Secret` | `yativo_sk_...` | No. Shown once, when the key is created |

See [Authentication](/yativo-fiat/authentication) for how to send them.

***

## Keys and your team

* **Keys belong to your business, not to a person.** A key keeps working if the teammate who created it leaves.
* **Keys act as your business account.** Anyone holding a key and secret can use the API on your behalf, so give the permission to create keys only to people you trust with that access.
* **Keys don't expire.** They work until someone on your team revokes them.
* **Keys are for servers only.** Never put one in a browser, mobile app or public repository.

### Who can manage keys

| Role | View keys | Create keys and edit allowed IPs | Revoke keys |
| - | - | - | - |
| Owner | Yes | Yes | Yes |
| Admin | Yes | Yes | Yes |
| Viewer | Yes | No | No |

The account owner can change which roles have these permissions on the **Team** page.

***

## Create a key

<Steps>
  <Step title="Open API Keys">
    Sign in to [app.yativo.com](https://app.yativo.com) and go to **Developers → API Keys**.
  </Step>

  <Step title="Generate a key">
    Click **Generate key**.
  </Step>

  <Step title="Add a label and allowed IPs">
    Enter a **Label** so your team can tell keys apart, and the public IPs of the servers that will use the key. At least one IP is required. See [IP whitelisting](/yativo-fiat/ip-allowlist).
  </Step>

  <Step title="Save the secret">
    Copy the **API secret** into your secrets manager before closing the window. It can't be shown again.
  </Step>
</Steps>

<Tip>
  Create one key per system (for example "Production backend" and "Reporting job"). You can then revoke one without affecting the others.
</Tip>

***

## Change a key's allowed IPs

In **Developers → API Keys**, click **Edit IPs** on the key. The list you save replaces the current one. The key and secret don't change, so there's nothing to redeploy.

When moving to a new server, add the new IP first, deploy, then remove the old one.

***

## Rotate a key

<Steps>
  <Step title="Create a new key">
    Create a new key with the same allowed IPs.
  </Step>

  <Step title="Deploy it">
    Deploy the new key and secret to your servers.
  </Step>

  <Step title="Confirm traffic has moved">
    Check that the old key's **Last used** time has stopped changing.
  </Step>

  <Step title="Revoke the old key">
    Revoke the old key in the dashboard.
  </Step>
</Steps>

***

## Revoke a key

In **Developers → API Keys**, click **Revoke** on the key. It stops working immediately and can't be restored.

<Warning>
  If a secret may have leaked, revoke the key straight away, then create a new one.
</Warning>

***

## Legacy API keys

The Account ID and App Secret shown under **Legacy API keys** on the same page are deprecated. From **15 October 2026** they stop working for requests from your servers. Move to the API keys above: see [Migrate from legacy API keys](/yativo-fiat/authentication#migrate-from-legacy-api-keys).

***

## FAQ

<AccordionGroup>
  <Accordion title="I lost the secret. Can Yativo show it again?">
    No. Only a hash of the secret is stored. Create a new key, deploy it, then revoke the old one.
  </Accordion>

  <Accordion title="Can I create or revoke keys through the API?">
    No. From 15 October 2026, API keys and IP whitelists can only be managed in the dashboard.
  </Accordion>

  <Accordion title="Do my teammates need their own keys?">
    No. Keys belong to the business. Teammates sign in to the dashboard with their own email code or [passkey](/yativo-fiat/passkeys).
  </Accordion>

  <Accordion title="Do sandbox keys work in production?">
    No. Each environment has its own keys. Create a separate key in each one.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.