> ## Documentation Index
> Fetch the complete documentation index at: https://docs.yalg.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Manage YALG API key lifecycle, storage, rotation, and revocation.

API keys are named credentials created by a signed-in YALG user from `Settings > Developer`.

## Lifecycle

1. Create a named key for an integration or environment.
2. Copy the full secret once.
3. Store it in a server-side secret manager or environment variable.
4. Use it in the `x-api-key` header.
5. Rotate it when team membership, infrastructure, or exposure risk changes.
6. Revoke keys that are no longer needed.

<Warning>
  API keys are shown once. Store them in a server-side secret manager or
  environment variable, and never expose them in client-side code.
</Warning>

## Naming

Use names that make ownership and purpose obvious:

* `production-crm-sync`
* `staging-internal-dashboard`
* `zapier-content-pipeline`
* `analytics-export-worker`

Avoid generic names like `test`, `my key`, or `integration`.

## Rotation

To rotate a key with minimal interruption:

1. Create a new key.
2. Deploy the new key to your integration.
3. Confirm successful requests.
4. Revoke the old key.

## Access model

API keys inherit the feature access and resource ownership of the user who created them. If the owner does not have access to a feature, the key cannot use that feature.