> For the complete documentation index, see [llms.txt](https://docs.cortecs.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortecs.ai/web-console/api-keys.md).

# API Keys

Create, assign, and manage API keys for project workloads

API keys let applications and services send requests through Cortecs. Each API key belongs to one project member and one team, making it possible to attribute usage and apply the correct budgets.

Open [**Console > Credentials**](https://cortecs.ai/userArea/console?tab=credentials) to manage your keys.

***

## Create an API key

1. Click **Create API key**.
2. Enter a unique key name that identifies the application or workload.
3. Select a **Team**.
4. Enable **Management key** only if the key needs access to management functions.
5. Click **Create**.
6. Copy and save the new key when it is shown.

{% hint style="warning" %}
The complete API key is shown only once. Store it securely and do not share it in messages, documents, or source code.
{% endhint %}

***

## Assign a key to a team

The team selection determines where the key's requests appear in usage reports and which team budgets and inference settings apply.

The list contains the teams to which the key owner belongs. When the owner belongs to only one team, that team is selected automatically.

<figure><img src="https://2211217319-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYGsEKyV2Zq4Q8fEJQT40%2Fuploads%2Fgit-blob-f00488a9e6cbe3a68497b1d1100fb958752bf73e%2Fteam-api-key-assignment.png?alt=media" alt="Team selection when creating a new API key" width="575"><figcaption><p>Assign each new API key to one of the key owner's teams.</p></figcaption></figure>

{% hint style="info" %}
The team is chosen when the API key is created. Use a separate team-specific key for each workload you want to track independently.
{% endhint %}

For information about creating teams and assigning members, see [Teams](/web-console/teams.md).

***

## Legacy API keys

Existing keys that were created before team assignment was available remain associated with the system-managed **Default** team.

{% hint style="warning" %}
**DEPRECATION NOTE** If you created your API key before the 1st of May 2026, you need to rotate it (delete and recreate) for API key-level budget tracking to work correctly. Keys created after that date work automatically.
{% endhint %}

***

## Review project member API keys

Project administrators can use **Project Member API Keys** in the Credentials tab to review keys owned by other project members. The list shows identifying information such as the owner, key name, assigned team, and creation date. It does not reveal the complete key value.

***

## Delete an API key

Delete a key when it is no longer needed or may have been exposed.

1. Update or stop every application that uses the key.
2. In the Credentials tab, find the key.
3. Click the **Delete** icon.
4. Confirm the deletion.

Deleting a key prevents any further requests with that key and removes its key-specific budget.

***

## Rotate API keys

Rotating an API key means replacing it with a new key and deleting the old one. Rotating keys periodically reduces the risk of an older key remaining usable if it was copied, shared, or exposed without your knowledge.

To rotate a key without interrupting your application:

1. Create a new API key for the same team and purpose.
2. Copy the new key and update every application or service that uses the old key.
3. Confirm that requests work with the new key.
4. Delete the old API key.

Choose a regular rotation schedule that fits your organization's security requirements. Rotate a key immediately if you suspect that it has been exposed or accessed by someone who should not have it.

{% hint style="warning" %}
Do not delete the old key until all applications have been updated and tested. Requests using a deleted key stop working immediately.
{% endhint %}