> For the complete documentation index, see [llms.txt](https://docs.baas.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.baas.sh/baas-console/api-settings/secret-keys/manage-a-key.md).

# Manage a key

Activate or deactivate a secret key, edit its allowed IP ranges and name, and revoke it.

Open **Console → Settings → API Settings → API Keys**, then click a key to open its page. The header shows the name, an **Active** or **Inactive** badge, the creation date, and the **Active** toggle.

The **Overview** tab holds a **Secret Key** card and the key's allowed IP ranges. The card shows only the masked placeholder `sb_secret_••••`; the full key appeared once at creation and cannot be retrieved. The **Settings** tab holds the name, description, and revocation.

Use **← API Keys** above the key to return to the list.

## Activate and deactivate

The toggle in the header switches the key between **Active** and **Inactive**. New keys start **Active**.

Deactivating is the safe pause button: calls made with an **Inactive** key are rejected the moment you flip it, and accepted again the moment you flip it back. Nothing else about the key changes.

## Restrict by IP

On the **Overview** tab, the **Allowed IP Ranges (CIDR)** card lists the ranges the key may be used from, one chip per range. While the list has entries, a call from outside them is rejected. When it is empty, the card reads **No IP restrictions** and the key works from anywhere.

To add a range, click the **+** button. The dialog asks for a **CIDR** range; type it and press Enter to add it. In our example, `203.0.113.0/24`, the range your backend calls from.

IPv4 and IPv6 ranges both work. Every entry ends with a `/` and a number, so a single address is written as its own range, `203.0.113.10/32`. Anything else is flagged as an invalid format on the spot.

To remove a range, use the **X** on its chip and confirm. Changes on this card take effect immediately, with no Save. After a removal, only the remaining ranges are allowed. Removing the last range allows every IP.

{% hint style="info" %}
**An empty list accepts every IP.** Restrictions are opt-in, and the list page flags a key with no ranges as **No restrictions**. Give keys that guard production at least one range.
{% endhint %}

## Rename and describe

Open the **Settings** tab. The **Settings** card holds the two fields from creation:

* **Name**, one word of letters, numbers, and underscores. It stays unique in your project.
* **Description (optional)**, shown only here.

Click **Save** to apply. Renaming changes nothing for the services using the key, because the key value stays the same.

## Rotate a key

Rotate when a key may have leaked, or on the schedule your security policy sets. Rotation is a short swap you make in a few steps:

{% stepper %}
{% step %}

### Create the replacement

On [API Keys](/baas-console/api-settings/secret-keys.md), create a new key with the same IP ranges. In our example, `backend_production_2`.
{% endstep %}

{% step %}

### Move your service

Update your server's configuration to send the new key, and confirm its calls go through.
{% endstep %}

{% step %}

### Revoke the old key

Back on the old key's page, revoke it. Until you do, both keys work, so the switch has no downtime.
{% endstep %}
{% endstepper %}

## Revoke a key

When a service retires for good, open the **Settings** tab. In the **Danger Zone**, click **Permanently Revoke Key** and confirm. You land back on the list.

{% hint style="warning" %}
**Revoking deletes for good.** The key is removed permanently, and any service still sending it loses access on its next call. To stop a key with a way back, [deactivate](#activate-and-deactivate) it instead.
{% endhint %}

## Next

* [API Settings](/baas-console/api-settings.md): allowed browser domains and server-side API keys.
* [API Keys](/baas-console/api-settings/secret-keys.md): back to the section overview.