> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracklysms.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Manage API keys for programmatic access

API keys allow programmatic access to the Trackly SMS API. Create, manage, and revoke keys from the dashboard.

## Who Can Manage Keys

Only **Owners** can create, view, and delete API keys. Members and Viewers cannot access API key management.

## Creating an API Key

1. Go to **Settings > API Keys**
2. Click **Create API Key**
3. Enter a name (e.g., "Production API", "Development")
4. Click **Create**
5. **Copy the key immediately** — it won't be shown again

<Warning>
  API keys are shown only once at creation. Store them securely. If lost, create a new key.
</Warning>

## Key Properties

| Property      | Description                                                                                                    |
| ------------- | -------------------------------------------------------------------------------------------------------------- |
| **Name**      | Descriptive label for your reference                                                                           |
| **Key**       | The secret value, format: `trk_[32-char-alphanumeric]` (shown once at creation, then masked as `trk_****xxxx`) |
| **Created**   | When the key was created                                                                                       |
| **Last Used** | When the key was last used for an API call                                                                     |
| **Status**    | Active or revoked                                                                                              |

## Using API Keys

Include the key in the `X-Api-Key` header:

```bash theme={null}
curl -X POST https://api.tracklysms.com/api/v2/send \
  -H "X-Api-Key: trk_your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"to": "+1...", "body": "Hello", "from_phone_number_id": "pn_..."}'
```

See [API Authentication](/api-reference/authentication) for details.

## Revoking Keys

To revoke (delete) a key:

1. Go to **Settings > API Keys**
2. Find the key
3. Click **Delete**
4. Confirm deletion

<Warning>
  Revocation is immediate. Any systems using this key will immediately fail with 401 errors.
</Warning>

## Key Rotation

Best practice: Rotate keys periodically.

1. Create a new key
2. Update your systems to use the new key
3. Verify the new key works
4. Delete the old key

## Multiple Keys

You can have multiple active keys:

| Key                 | Use Case                |
| ------------------- | ----------------------- |
| Production API      | Live application        |
| Development         | Testing and development |
| Partner Integration | Third-party access      |

This allows:

* Rotating one without affecting others
* Different access for different systems
* Easier tracking of which system uses which key

## Discord Linking

API keys are also used to link Discord accounts:

```
/sms link YOUR_API_KEY
```

The key verifies your identity and links Discord to your account.

## Security Best Practices

<AccordionGroup>
  <Accordion title="Never commit keys to git">
    Use environment variables or secret managers. Add keys to `.gitignore`.
  </Accordion>

  <Accordion title="Use separate keys per environment">
    Different keys for dev, staging, production. Easier to rotate and track.
  </Accordion>

  <Accordion title="Monitor Last Used">
    Check the "Last Used" column. If a key hasn't been used in months, consider revoking.
  </Accordion>

  <Accordion title="Rotate after team changes">
    When team members with key access leave, rotate keys as a precaution.
  </Accordion>
</AccordionGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="401 Unauthorized">
    * Check the key is correct (no extra spaces)
    * Verify the key hasn't been revoked
    * Ensure you're using `X-Api-Key` header
  </Accordion>

  <Accordion title="Lost API key">
    Keys can't be recovered. Create a new one and update your systems.
  </Accordion>

  <Accordion title="Can't create keys">
    Only Owners can manage API keys. Ask an Owner for a key or to upgrade your role.
  </Accordion>
</AccordionGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="API Reference" icon="code" href="/api-reference/introduction">
    Start making API calls
  </Card>

  <Card title="Billing" icon="credit-card" href="/account/billing">
    View usage and costs
  </Card>
</CardGroup>