# Configuration: API Keys Tab

Your API key authenticates your integration with Incode's APIs and is associated with your account. This tab shows a table with information about the API keys used in your Incode implementation. You cannot change any of the information, but you can:

- Generate new keys
- Copy existing keys
- Revoke existing keys

The API Keys tab displays a table of all keys associated with your account. Each row shows:

| Column           | Description                                                                                                                                                                                                                                                                     |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Name**         | The name assigned to the key. A green dot indicates an active key. A gray dot indicates a revoked key.                                                                                                                                                                          |
| **Client ID**    | The Client ID associated with the key. {/* SME REVIEW: Source docs flagged this as unverified — two keys generated in the same environment showed different Client IDs, which may contradict the "unique ID of the client" description. Verify with Ilse before publishing. */} |
| **API Key**      | The key value (copyable from this column).                                                                                                                                                                                                                                      |
| **Last Updated** | Updated only when the key is revoked. For active keys, this matches Time Created.                                                                                                                                                                                               |
| **Time Created** | The date and time the key was originally generated.                                                                                                                                                                                                                             |

## Generate a New API Key

Generate additional keys to segment access by team, application, or environment; for example, separate keys for your iOS app, your web app, and your CI pipeline.

1. In the left menu, click **Configuration**.
2. Click the **API Keys** tab.
3. Click **Generate New API Key** in the lower right corner of the page.

Dashboard displays a notification while the key is being generated. Once ready, the new key appears at the top of the API Keys table.

## Copy an Existing API Key

If you need to retrieve a key you've already generated, you can copy it directly from the table. 

1. In the left menu, click **Configuration**.
2. Click the **API Keys** tab.
3. Find the key you want to copy and click **Copy** in the **_API Key_** column for that key.

## Rotate an API Key

Rotate keys periodically as a security practice, or immediately if a key may have been exposed. The correct sequence is: generate a new key first, update your application to use it, then revoke the old key. This order avoids any gap in API access.

<Callout icon="❗" theme="error">
  ### Warning

  Revoking a key immediately aborts all active onboarding sessions that were initialized with that key. Plan rotations during low-traffic periods where possible, or ensure your application handles the interruption gracefully.
</Callout>

When a key is revoked mid-session, Incode SDKs surface a key-revoked error so your application can handle the transition. For example, your app could reinitialize the SDK with the new key and restart the session. See the SDK reference for your platform for the specific error type and handling pattern.

You can rotate an API key for [Android](https://developer.incode.com/docs/android-api-key-rotation) and [iOS](https://developer.incode.com/docs/ios-api-key-rotation). Hybrid SDKs do not individually offer this capability.

## Revoke an Existing API Key

<Callout icon="❗" theme="error">
  ### Warning

  Revoking an API key cannot be undone. Any application using the revoked key will immediately lose API access, and any active onboarding sessions using that key will be aborted. Make sure the key is no longer in use — or that your application is prepared to handle the interruption — before revoking.
</Callout>

1. In the left menu, click **Configuration**.
2. Click **API Keys**.
3. In the API Keys table, locate the key you want to revoke and click **Revoke** in the **Name** column for that row.

***

## API Key Security

Treat your API key like any other credential. Store it securely and keep it server-side instead of client-side or in front-end code. Avoid sharing it in tickets, emails, images, or public repositories. If a key may have been exposed, generate a new key and [revoke the affected one](#revoke-an-existing-api-key).

<br />