---
title: API keys
description: Create, rotate, and revoke the Project-bound keys that authenticate your servers and agents.
sidebar:
  order: 1
---

API keys authenticate servers and MCP clients. Each key starts with
`emitkit_` followed by 12 letters, belongs to one Organization, and is bound to
one Project: the events it sends land in that Project. A key can create events,
identify users, and erase identities for its Organization. Keys don't expire.

Every member can see the Organization's keys (by name and visible prefix).
Only owners and admins can create, rotate, or revoke them.

## Create a key

1. **Open API keys**

    In the dashboard, open **Settings → API keys**.

2. **Name it and pick the Project**

    Choose a recognizable name and the Project its events belong to.

3. **Store the secret**

    The key is shown once. Copy it into a secret manager straight away. Don't
    put it in a browser bundle, mobile app, URL, repository, log, or analytics
    property.

EmitKit stores only a hash of the key, so it can't show it again. If you lose
a key, rotate it.

## Rotate or revoke

**Rotate** a key when an integration changes owners, the secret may have been
exposed, or your policy requires it. Rotation creates a new key with the same
name and Project and deletes the old one immediately, so update the
integration right away. Idempotency keys used with the old key don't carry
over.

**Revoke** deletes the key immediately. Requests that use it get `401`.

If a key's Project is deleted, the key can't create events (`403`) until the
Project is restored. Deleted Projects are purged after 90 days, together with
their keys.

:::warning
Never send a real key in a support request. Share its name or visible prefix
instead.
:::