> ## Documentation Index
> Fetch the complete documentation index at: https://docs.datalyr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Generate and rotate workspace keys safely.

Open **Settings → API** to manage two workspace-scoped keys.

## Choose the right key

* **Agent key** (`dk_agent_…`): for AI Chat, MCP clients, and services reading from the public `/v1` API.
* **Write key** (`dk_…`): for server SDKs and supported server-side write flows.

These keys are secrets. Do not put either one in browser code. Client-side Web SDK setup uses the public workspace ID instead.

## Generate a key

1. Find the key type you need.
2. Select **Generate key**.
3. Confirm the action.
4. Copy the full value from the one-time dialog.
5. Store it in an environment variable or secret manager.

Datalyr only shows the full value once. After closing the dialog, the page displays a masked preview.

## Rotate a key

Rotation invalidates the current key immediately.

1. Identify every service using the current key.
2. Select **Regenerate** and confirm.
3. Copy the new value before closing the dialog.
4. Update every dependent environment.
5. deploy or restart those services.
6. Verify one authenticated request.

There is no overlap period between old and new keys, so plan rotation when a brief coordinated update is safe.

## If a key is exposed

Regenerate it immediately, update dependents, and review relevant service logs for unexpected use. Never send a full key to support; share only its prefix and masked ending when identifying which credential is involved.

<Note>
  Keys belong to the active workspace. A valid key from another workspace will not return or write the data you expected here.
</Note>