> For the complete documentation index, see [llms.txt](https://onchainlabs-tech-documentation.gitbook.io/wallettwo-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://onchainlabs-tech-documentation.gitbook.io/wallettwo-documentation/api/configure-an-api-key.md).

# Configure an API Key

## API Keys

API keys are the credentials your backend uses to talk to Engage and the WalletTwo platform on behalf of your company. Every request your servers make — reading balances, triggering workflows, issuing tokens, querying events — is authenticated with a key you issue from this page.

You'll find it in the sidebar under **Dashboard → API Keys**. The page is gated: if it doesn't appear, your role doesn't include API key access — ask an admin to grant it.

### Create an API key

1. Click **Create API Key** at the top right of the page.
2. In the **Create API Key** modal, fill in the **Name** field — this is how you'll recognize the key later, so use something descriptive like `backend-prod`, `webhook-ingest`, or `analytics-read`.
3. Click **Create**.

On success:

* A **"API Key created successfully"** toast appears.
* The new key shows up at the **top of the table**.
* The **Secret** column displays the key value inline, next to a **Copy** button.

The **Name** is required. Submitting an empty name shows a *"Name is required"* error; cancelling the modal discards the draft.

> You cannot edit a key after creation. If you need a different name, create a new key and delete the old one.

#### Copy the secret immediately

The full secret is only displayed **at creation time** (and for the current session). Once you reload the page or navigate away, the Secret column will show *"Hidden"* instead of the value and there is no way to reveal it again.

**What to do:**

1. As soon as the key appears in the table, click **Copy**. The button changes to **"Copied!"** for three seconds as confirmation.
2. Paste the secret into your secrets manager, CI environment variables, or backend configuration.
3. Treat it like a password — never commit it to source control, never paste it into chats or tickets, never send it over email.

If you lose a secret before copying it, your only option is to **delete the key and create a new one**.

### Delete an API key

Deleting a key is the way to revoke programmatic access for whatever system was using it.

1. Find the key's row in the table and click the red **Delete** button in the **Actions** column.
2. A confirmation modal appears titled **"Delete API Key"** with the warning *"Are you sure you want to delete this API Key? This action cannot be undone."*
3. Confirm to proceed, or close the modal to cancel.

On success:

* The row disappears from the table.
* A **"API Key deleted successfully"** toast appears.
* Any server using that key will start receiving authentication errors on its next request — **rotate in a replacement key first** if you can't tolerate downtime.

### Rotating a key safely

There is no in-place rotate action — rotation is a two-step process:

1. **Create a new key** (e.g. `backend-prod-2025-04`).
2. Copy the new secret and deploy it to the system that needs it.
3. Once the new key is live and verified, **delete the old key**.

Doing it in this order avoids an outage window between revocation and re-deploy.

### Security recommendations

* **One key per integration.** Separate keys for separate services (backend, CI, analytics) make rotation and revocation surgical rather than disruptive.
* **Name keys for their owner.** Encode the environment and service in the name — `ingest-staging`, `analytics-prod` — so the Created At column plus the name tells you everything at a glance.
* **Rotate on a schedule** and immediately after anyone with access to the secret leaves the team.
* **Store secrets in a vault** (1Password, AWS Secrets Manager, Vercel/Netlify env vars, etc.) — never in repo files, shared drives, or chat.
* **Revoke on compromise.** If you suspect a key has leaked, delete it from this page first, then investigate.

### Troubleshooting

**I just created a key and the Secret column shows *****"Hidden"*****.** You reloaded the page or navigated away before copying. Delete the key and create a new one, then copy the secret immediately.

**The Copy button didn't confirm with "Copied!".** Your browser blocked clipboard access. You'll see a *"Failed to copy secret"* error. Grant clipboard permissions or select the secret text manually.

**I don't see the API Keys page in the sidebar.** Your role doesn't include API key management for this company. Ask an administrator to adjust your role from **Members**.

**My server is getting authentication errors after a deploy.** Check whether the key was recently deleted on this page. If so, create a new one and update the environment variable in your deploy.