# API keys

Every request needs a key, sent as a bearer token.

```text
Authorization: Bearer cl-your-key
```

## Create a key

1. Sign in to the [console](/console) with your email.
2. Click **Create a key** and give it a name you will recognise, such as the app or server that uses it.
3. Copy the key straight away.

We store only a scrambled version of each key, so we cannot show it to you again. If you lose it, delete it and create another.

You can have up to 10 keys. Use a separate key for each app, so you can delete one without breaking the others.

## Delete a key

Click **Delete** next to the key in the console. Requests using it stop working straight away.

Delete a key immediately if it may have been exposed, for example pasted into a chat, committed to a public repository or shown in a screenshot.

## Keep keys safe

- Keep keys on your server. Never put a key in code that runs in a browser or a mobile app, where anyone can read it.
- Store keys in environment variables or a secrets manager, not in your source code.
- Give each environment, such as development and production, its own key.

## What a key can do

A key can call the API and spend your account's credit. It cannot sign in to the console, change your account or create other keys.