# Keys and authentication

Organization API keys for your server, one-time secret display, and access revocation.

Source: https://shvydko.ai/en/docs/api/authentication

## Creating a key

An owner or admin opens API Keys in the relevant organization and gives the key a clear name, such as support-staging. The secret is displayed once. The list retains the name and prefix for identification.

A key belongs to an organization: its balance, limits, and Usage apply to all its keys. Selecting another organization in your account does not transfer an existing key.

- [Manage keys](https://shvydko.ai/en/console/keys)

## Sending the key

Call the API from a trusted server. Do not put the secret in public NEXT_PUBLIC_ variables or localStorage. For a browser application, create your own server endpoint with user authentication.

External /v1 endpoints use a Bearer key. The account's session cookie and active-organization header are not required for /v1 integration.

### HTTP header

```http
Authorization: Bearer <SHVYDKO_API_KEY>
```

## Rotation and revocation

A revoked, unknown, or missing key returns HTTP 401. Do not log Authorization or include it in a support request about an error.

- Create a new key and update the secret in your server environment.
- Test a GET /v1/models request with the new key.
- Revoke the old key in your account.
- If a key leaks, revoke it immediately; its full value cannot be retrieved again.

## Related documentation

- [First request](https://shvydko.ai/en/docs-markdown/quickstart.md)
- [Errors and retries](https://shvydko.ai/en/docs-markdown/api/errors.md)
- [Routing support requests](https://shvydko.ai/en/docs-markdown/patterns/routing.md)