What Are API Keys?

API keys are credentials that identify and authorize you when making requests to Authenta’s API.

Each key contains:

• API Key → A unique token used to authenticate requests
• Assigned permissions → Which operations the key can perform
• Creation date → When the key was created

⚠️ The API key is shown only once when created.
You must store it securely — Authenta does not display it again.

Where to Manage API Keys

Navigate to:

Here you will see:

• A list of your existing keys
• Their permissions
• When each key was last used
• Options to create or revoke keys

If you have no keys yet, you will see a Create API Key button.

Creating a New API Key

Click Create API Key to open the creation dialog.
You will be prompted to configure:

1. Key Name

A label used to help you identify the purpose of the key.

Examples:

• Backend-Server-Key
• Batch-Jobs-Key
• Video-Pipeline-Key

2. Permissions

Authenta supports the following permission types:

Permissions restrict which API operations a key may perform. A request the key isn't allowed to make returns 403 FORBIDDEN.

Viewing API Keys

After a key is created, you will see:

• Key name
• Permissions
• Date created
• Options to manage the key

Viewing the API Key

After creation, the API key is not shown again.
If you lose the key:

• You must regenerate it
• The previous key becomes invalid immediately

Regenerating the API Key

If your key has been lost or compromised:

1. Open the key details
2. Click Regenerate
3. Copy the new key immediately
4. Update your services to use the new key

A regenerated key:

• Invalidates the old key
• Does not change your Key Name
• Does not reset key-level permissions
• Does not affect your usage history

Revoking an API Key

If a key is no longer needed:

1. Open the key details
2. Click Revoke Key
3. Confirm the action

Revoking a key:

• Immediately invalidates the key; further requests with it return 401 INVALID_API_KEY
• Does not delete the jobs created with it, or your usage history

You may revoke a key at any time for security or cleanup purposes.

Best Practices for API Keys

To maintain secure and stable integrations:

🔒 1. Store Secrets Securely

Use environment variables, secret managers, or encrypted credential stores.
Never hard-code secrets into your source code.

🚫 2. Do Not Share API Keys

Anyone holding a key can act on your account: read every job and its media, and spend your credits. Give each person or system its own key instead.

🔄 3. Rotate Keys Regularly

Regenerate secrets periodically to reduce long-term exposure risk.

🎯 4. Use Separate Keys for Separate Systems

Examples:

• One key for your backend server
• Another for automated batch processing
• Another for testing environments

This gives you fine-grained control and safer isolation.

📉 5. Monitor Usage

Check each key's last-used date in Settings → API Keys, and your credit spend in Settings → Billing. Revoke keys you no longer use.

Keeping keys safe

An API key is a long-lived secret with access to every job on your account. Only use it from servers you control.

For apps that capture media on a device, send the media to your own backend and call Authenta from there:

1. The app uploads the capture to your backend, authenticated with your own user session.
2. Your backend creates the Authenta job with its API key, uploads the file and finalizes the job.
3. Your backend polls for the result and returns only what the app needs, for example the verdict.

If you suspect a key has leaked, regenerate or revoke it immediately.

Next Steps

Once your key is created and configured:

• Learn how to authenticate API calls
• Start making API calls
• View endpoint details in the Jobs API Reference

Managing API keys correctly ensures secure and reliable access to the Authenta API.