> ## Documentation Index
> Fetch the complete documentation index at: https://docs.afkcrypto.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API keys: creation, format, usage, limits, and security best practices

## API keys

All v1 endpoints require an API key in the `x-api-key` header.

### Creating API keys

1. Sign in to the [AFKCrypto dashboard](https://app.afkcrypto.com)
2. Go to the [API Keys](https://app.afkcrypto.com/api-keys) section
3. Click "Generate API Key"
4. Give your key a descriptive name
5. Optional: set an expiration (7 days, 30 days, 90 days, 180 days, or 1 year)
6. Copy the key immediately — it will not be shown again

### Key format

```text theme={null}
afk_<prefix>_<random>

Example: afk_xY3z_Ab12cD34Ef56Gh78Ij90Kl12Mn34Op56
```

* **Prefix**: 4-character identifier for quick lookup
* **Random**: 32-character cryptographically secure random string

### Using API keys

Include the key with every request in the `x-api-key` header:

```bash theme={null}
curl -X GET https://api.afkcrypto.com/api/v1/wallets \
  -H "x-api-key: afk_xY3z_Ab12cD34Ef56Gh78Ij90Kl12Mn34Op56"
```

### Security best practices

* **Never commit API keys to version control** — use environment variables
* **Rotate keys regularly** — set expiration for temporary access
* **Use separate keys per environment** — dev, staging, production
* **Revoke unused keys immediately** — reduce attack surface
* **Store securely** — use a secrets manager (for example, AWS Secrets Manager or HashiCorp Vault)

### Key expiration

API keys can optionally expire after a specified period:

* **Never expires** (default): works until revoked
* **7 days**: short-term testing or demos
* **30 days**: contractor access or trials
* **90 days**: recommended for quarterly rotation
* **180 days**: semi-annual rotation
* **1 year**: annual rotation for stable integrations

What happens when a key expires?

* Requests with that key return HTTP 401 `UNAUTHORIZED`
* The key remains visible in the dashboard for audit history
* Create a new key to replace it as needed

Monitoring expiration:

* Dashboard labels keys as "Expired" or "Expiring soon" (≤ 7 days)
* Configure alerts to avoid interruptions

### Key limits

* **Maximum active keys**: 10 per user
* **Rate limits** apply; see [Rate limiting](/api-reference/introduction/#rate-limiting)
* Revoke unused keys to stay under the limit

### Revoking API keys

Revoke a key immediately in the dashboard:

1. Open [API Keys](https://app.afkcrypto.com/api-keys)
2. Find the key to revoke
3. Click "Revoke Key"
4. Confirm the action

Note: Revocation is permanent and takes effect immediately.

## Related

<CardGroup cols={2}>
  <Card title="API reference" icon="terminal" href="/api-reference/introduction/" />

  <Card title="Policies & Security" icon="shield" href="/api-reference/policies-security/" />

  <Card title="Supported chains" icon="link-simple" href="/api-reference/supported-chains/" />
</CardGroup>