> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stateset.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Create, list, and revoke StateSet Cloud API keys — from the dashboard or the CLI.

# API Keys

An API key authenticates REST calls to the StateSet API, whether from the `stateset-node` SDK,
another client library, the CLI, or your own service.

## From the CLI

```bash theme={null}
# List existing keys
stateset cloud api-keys list

# Create one, named for where it will be used
stateset cloud api-keys create --name "ci-bot"

# Revoke by id
stateset cloud api-keys revoke 12
```

<Warning>
  A newly created key is shown **once**. Store it in a secret manager immediately — it cannot be
  retrieved afterwards, only revoked and replaced.
</Warning>

## From the dashboard

1. Open the **Keys** tab.
2. Click **Create API Key**.
3. Enter a name.
4. Click **Add Key**, then copy the value.

## Using a key

Store the key with the CLI so subsequent commands pick it up:

```bash theme={null}
stateset cloud login --api-key $STATESET_API_KEY
stateset cloud whoami          # confirm which identity the key resolves to
```

Or send it directly:

```bash theme={null}
curl https://api.stateset.com/v1/projects \
  -H "Authorization: Bearer $STATESET_API_KEY"
```

## Naming keys for what they do

Name each key after the system that holds it — `ci-bot`, `sync-worker`, `laptop-dom`. When you
need to revoke one, the name is what tells you what breaks.

<Tip>
  Issue a **separate key per consumer** rather than sharing one. Revoking a shared key takes down
  everything that used it; revoking a scoped key takes down one thing you already identified.
</Tip>

## Rotation

There is no in-place rotation. To rotate:

1. Create the replacement key.
2. Deploy it wherever the old key is used.
3. Confirm traffic has moved — `stateset cloud whoami` from the consumer, or check logs.
4. Revoke the old key.

Doing it in that order means no window where neither key works.

## Related

* [Authentication](/cloud-api-reference/authentication) — tokens and the auth model
* [Cloud Overview](/cloud-api-reference/overview)