> ## Documentation Index
> Fetch the complete documentation index at: https://docs.octokraft.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Create and manage API keys for programmatic access

# API Keys

API keys provide programmatic access to the Corbulo API. Use them to connect MCP servers, CI pipelines, custom scripts, and other integrations.

***

## Creating an API Key

<Steps>
  <Step title="Open API Key settings">
    Go to **Settings > API Keys** in your project.
  </Step>

  <Step title="Create a new key">
    Click **Create API Key**.
  </Step>

  <Step title="Name the key">
    Give the key a descriptive name that identifies its purpose -- for example, "MCP Server", "CI Pipeline", or "Metrics Dashboard".
  </Step>

  <Step title="Copy the key">
    Copy the API key immediately. It will not be shown again. Store it securely.
  </Step>
</Steps>

<Warning>
  API keys are displayed only once at creation time. If you lose a key, revoke it and create a new one.
</Warning>

***

## Using API Keys

Include the key in the `Authorization` header of your HTTP requests:

```bash theme={null}
curl "https://api.corbulo.dev/api/v1/projects" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

All API endpoints that accept API key authentication use the same `Bearer` token format.

***

## Managing Keys

From **Settings > API Keys**, you can:

* **View all active keys** with their names and last-used dates.
* **Revoke keys** that are no longer needed. Revocation is immediate -- any request using a revoked key will be rejected.
* **Create project-scoped keys** that only have access to a specific project.

***

## Best Practices

<CardGroup cols={2}>
  <Card title="Use descriptive names">
    Name each key after its purpose so you can audit usage later. "CI Pipeline - GitHub Actions" is better than "key-1".
  </Card>

  <Card title="One key per integration">
    Use separate keys for MCP, CI, scripts, and other integrations. If one is compromised, you can revoke it without affecting the others.
  </Card>

  <Card title="Revoke unused keys">
    When a team member leaves or an integration is decommissioned, revoke the associated key immediately.
  </Card>

  <Card title="Never commit keys to source control">
    Store API keys in environment variables or a secrets manager. Do not hardcode them in configuration files that are checked into version control.
  </Card>
</CardGroup>