# Create an API key

Create an API key in Estactics and use it to authenticate your requests.

Every request to the API needs an API key. A key belongs to the person who created it, and it can only reach the data that person can see.

## Create a key

1. Sign in to [Estactics](http://localhost:3031).
2. Open **Account**, then **Tokens**, or go straight to [your tokens page](http://localhost:3031/dashboard/account/tokens).
3. Click **New token**.
4. Enter a name, and choose when the key expires.
5. Copy the key. It starts with `atsec_`, and **it is shown only once**.
6. Choose the permissions the key should have.

> [!NOTE]
> A new key starts with no permissions, so only a few basic endpoints work until you add some. You can only give a key permissions that you have yourself.

> [!NOTE]
> If you don't see the Tokens page, your role doesn't include API key management. Ask the owner of your Estactics account to enable it.

## Use the key

Send the key in the `Authorization` header of every request:

```text
Authorization: Bearer atsec_your_key
```

For example:

```bash
curl --request POST \
  --url http://localhost:4000/api/clients/search \
  --header 'Authorization: Bearer atsec_your_key' \
  --header 'Content-Type: application/json' \
  --data '{"fields": ["id", "fullName"], "limit": 5}'
```

## Keep your key safe

- Treat a key like a password. Anyone who has it can act as you, within its permissions.
- Keep keys on your server. Never put one in website code that visitors can read.
- Give each key only the permissions it needs.
- Use a separate key for each integration, so you can replace one without affecting the others.

## Limits and expiry

| Rule | Details |
|---|---|
| Keys per person | Up to 5 |
| Expiry | Optional. An expired key stops working and is removed. |
| Not used for 90 days | The key is disabled automatically. Rotate it to get a working key again. |
| Owner deactivated | The key stops working immediately. |

## Replace a key

To replace a key, rotate it from the Tokens page. You get a new key with the same permissions, and you choose how long the old one keeps working: it can stop immediately, or stay valid for 1 day, 2 days, 1 week or 1 month while you update your systems.

To cancel a key for good, delete it from the same page. It stops working on the next request.