# Create your first API key

API keys authenticate every request to the
gateway. They are bearer tokens — anyone holding the string can spend
your credits — so the rest of this page is about creating, scoping, and
rotating them safely.

## Create one

1. **Dashboard → Keys**.
2. Click **New key**.
3. Give it a name that describes where it will be used (`prod-server`,
   `local-dev`, `chatbox-personal`). The name appears in the usage
   history and helps you find the right key to rotate later.
4. Choose when it **expires**. Keys have a bounded lifetime — the
   default is **90 days**, matching the widely-used rotation baseline.
   Pick a shorter window for high-sensitivity integrations, a longer one
   (up to 12 months) for long-running workloads, or **Never** as a
   deliberate opt-out. An expired key stops authenticating and shows an
   `expired` badge in the dashboard so you know to rotate it.
5. Click **Create**. The full token shows once — copy it now.

Tokens look like `sk-lr-...` and are 40+ characters. The dashboard only
ever shows the prefix and last four characters again.

## Store it

- **Production** — in your secret manager (Vault, AWS Secrets Manager,
  GCP Secret Manager, sealed Kubernetes secret, …). Never in source
  control.
- **Local development** — in a `.env` file that is in `.gitignore`.
- **Personal tools** — in the OS keychain, or in the tool's own
  encrypted store. Avoid pasting the token into chat applications or
  notes apps that sync to the cloud.

A leaked key can be revoked from the dashboard at any time — see
*Rotate or revoke* below — but it can spend credits in the seconds
between the leak and the revocation. Treat keys like passwords.

## Use it

The header is the standard `Authorization: Bearer`:

```bash
curl https://api.lowrouter.ai/v1/chat/completions \
  -H "Authorization: Bearer $LOWROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "auto/mistralai/mistral-large-2512",
    "messages": [{"role": "user", "content": "Hello"}]
  }'
```

The `Authorization` header value is exactly `Bearer ` followed by the
token — no quotes, no spaces around the equals. SDKs accept the token
as the constructor's `apiKey`/`api_key` argument; see
[integrations](../integrations/).

## Rotate or revoke

- **Rotate** — create a second key, deploy it everywhere, then delete
  the old one. There is no built-in zero-downtime rotation; the pattern
  above gives you it without one.
- **Revoke** — **Dashboard → Keys → Delete**. The token stops working
  on the next request, no caching delay.
- **Expiry** — keys also lapse automatically at their expiry date
  (default 90 days). An expired key returns a `401 api_key_expired`
  error; create a fresh key and rotate it in. Expired keys stay listed
  (marked `expired`) as a reminder, but their secret is purged at rest.

Rotate at least every 90 days, and immediately after any of:

- A key was committed to a repository (even briefly).
- A key was sent over an insecure channel.
- A team member with access to the key left the organisation.
- Unexpected usage shows up on the dashboard.

## Next

[Run your first completion →](first-completion)