> For the complete documentation index, see [llms.txt](https://docs.baas.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.baas.sh/baas-console/api-settings/secret-keys.md).

# API Keys

Create the server-side keys your backend calls the API with, and restrict each one by IP.

Open **Console → Settings → API Settings → API Keys** to create and manage your project's server-side API keys. These secret credentials let a backend authenticate without a signed-in user.

An API key authenticates requests. A key from the [Vault](/dashboard/vault.md) signs blockchain transactions and is managed separately.

In our example, the backend behind `https://app.example.com` calls the project API at `https://my-project-api.baas.sh` with a key named `backend_production`.

{% hint style="info" %}
**A secret key never leaves your server.** Browser code needs no key at all: the [SDK](/baas-sdk/sdk.md) authenticates each call with the signed-in user's own token.
{% endhint %}

## What a secret key grants

A call that carries a secret key acts as your project, not as a user. It can read and write your contracts, manage your users and automations, and reach the rest of your project's API, all server to server.

Your service sends the key in the `apikey` request header. A secret key authenticates a call on its own, so the API rejects a request that also carries a signed-in user's token. To act as a specific user, go through the [SDK](/baas-sdk/sdk.md) instead.

The keys themselves are created and managed only here, in the Console.

## The list

Each key's row shows:

| Field               | What it shows                                                               |
| ------------------- | --------------------------------------------------------------------------- |
| **Name**            | The name you gave the key                                                   |
| **Key**             | The masked placeholder `sb_secret_••••`                                     |
| **IP Restrictions** | The allowed ranges, or **No IP restriction** when the key works from any IP |
| **Status**          | **Active** or **Inactive**                                                  |

Click a row to open the key on its own page, covered in [Manage a key](/baas-console/api-settings/secret-keys/manage-a-key.md).

Before the first key, the page reads **No API keys**, with a **Create API key** button to create it.

## Create a key

Give each service its own key, so rotating or revoking one never touches the others.

{% stepper %}
{% step %}

### Open the panel

Click **Create API key**.
{% endstep %}

{% step %}

### Name the key

Fill in **Name**, `backend_production` in our example. A name is one word of letters, numbers, and underscores. Each name is unique in your project. Add a **Description (optional)** when the name needs context; it appears later on the key's [Settings tab](/baas-console/api-settings/secret-keys/manage-a-key.md#rename-and-describe).
{% endstep %}

{% step %}

### Restrict by IP (optional)

Under **Allowed IP Ranges (CIDR)**, add the ranges your service calls from, `203.0.113.0/24` in our example. Leave the list empty to accept calls from any IP. Either way, the ranges stay editable on the key's page; the editor is covered in [Manage a key](/baas-console/api-settings/secret-keys/manage-a-key.md#restrict-by-ip).
{% endstep %}

{% step %}

### Create

Click **Create API key**. The panel shows **Your Secret Key** in full. It starts with `sb_secret_`.
{% endstep %}

{% step %}

### Copy the key

Click **Copy** and store the key where only your server reads it, like an environment variable or a secret manager. Then click **Done** to return to the list, where the new key appears **Active** and ready.
{% endstep %}
{% endstepper %}

{% hint style="warning" %}
**The full key shows once, at creation.** Once the panel closes, no one can display it again, not even the Console. If a key gets lost, create a new one and [revoke](/baas-console/api-settings/secret-keys/manage-a-key.md#revoke-a-key) the one it replaces.
{% endhint %}

## Next

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Manage a key</strong></td><td>Activate, restrict, rename, and revoke a key from its page.</td><td><a href="/baas-console/api-settings/secret-keys/manage-a-key.md">Manage a key</a></td></tr></tbody></table>