> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oncarbon.site/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create and manage the keys that authenticate your applications with the ingest API.

API keys belong to a space. Every event sent with a key lands in that space — the ingest API derives the space from the key, so the SDK never needs a space ID.

## Create a key

1. In the dashboard, go to **Settings → API Keys**.
2. Click **New** and name the key after the system that will use it (for example `production-api`).
3. Copy the key from the confirmation modal.

<Warning>
  The full key is shown only once, in the confirmation modal. Carbon stores a
  hash of the key, not the key itself — it cannot be recovered later. If a key
  is lost, create a new one.
</Warning>

Store the key as a secret in your deployment environment:

```bash .env theme={null}
CARBON_API_KEY=your-api-key
```

## Manage keys

The **Active Keys** table lists every key with its name, a key hint (the only part of the key that remains visible), status, and creation date.

* Use one key per environment or service so keys can be rotated independently.
* Delete a key to revoke it. Requests with a deleted key fail immediately with `401 Unauthorized`.

## Rotation

1. Create a new key.
2. Update the secret in your deployment environment.
3. Delete the old key once nothing uses it.

Events are unaffected by rotation — they belong to the space, not the key.