> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quotamint.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create, store, rotate, and revoke runtime credentials

Project API keys authenticate calls to `/v1/*`. They are scoped to one project and one environment.

## Key format

```text theme={null}
qm_test_<secret>
qm_live_<secret>
```

The secret contains 32 bytes from a cryptographically secure random source and is encoded as base64url.

## Send a key

Use the standard bearer header:

```http theme={null}
Authorization: Bearer qm_test_...
```

Malformed, unknown, revoked, and environment-mismatched keys all return `401`. Raw credentials and authorization headers are never written to logs.

## Secret handling

* Keep keys in a server-side environment or secret manager.
* Use a different key per service when independent revocation matters.
* Never expose a key in browser JavaScript, mobile app binaries, logs, or support screenshots.
* Rotate keys by creating the replacement before revoking the old one.

## Key status

A key can be `ACTIVE` or `REVOKED`. Revocation does not delete historical usage or ledger data. The dashboard shows when a key was last used, so you can confirm traffic has moved before retiring a replacement.