# API keys in the console

> Create, limit, inspect and revoke API keys from the console.

Page: https://docs.aggre.org/console/api-keys · Section: Console and accounts · All pages: https://docs.aggre.org/llms.txt

API keys authenticate calls to the [data API](https://docs.aggre.org/api/data.md). Manage them under **API keys** in an account (`app.aggre.org/{handle}/keys`). How a key is sent is in [Authentication](https://docs.aggre.org/authentication.md).

## Creating a key {#create}

Choose a name (1 to 80 characters), optionally a quota and its period, an IP allowlist and an expiry. The secret appears **once** in the confirmation; copy it then. Afterwards the list shows only the name, the 8-character prefix, the limits, `last used`, and the usage of the current period.

| Option | Notes |
|---|---|
| Name | Shown in the list, the usage page and the audit log. |
| Quota and period | `day`, `month` or `total`. The default is a monthly allowance shown on the form. You can lower it. |
| IP allowlist | CIDR ranges the key may be used from. Empty means any address. |
| Expiry | The key stops working at this time. |

Self-service limits: the quota cannot exceed the default allowance (a daily quota counts as up to 31 times its limit against it), it cannot be unlimited, the rate policy is `default`, and an account holds at most 20 active keys. Higher limits and unlimited keys are set by platform staff.

## Who can manage keys {#roles}

On your personal account you do. In an organization, **owners and admins** create, edit and revoke keys; members can see them. Every creation and revocation is written to the audit log ([Usage and audit log](https://docs.aggre.org/console/usage.md)).

## Revoking {#revoke}

Revoke from the list. The key stops working within about 30 seconds. Revocation cannot be undone; create a new key instead.

## Good practice {#practice}

- One key per application or environment, named for it, so usage and revocation are precise.
- Prefer an IP allowlist for servers with fixed addresses.
- Store keys in a secret manager, not in source control. If a key leaks, create a new one, deploy it, then revoke the old one.
- The console itself reads data for the data browser with a short-lived key of its own, created under your personal account. It is listed with your keys (named "Console browsing"), lasts 24 hours and is revoked when you sign out; it is not meant for your code.