> ## Documentation Index
> Fetch the complete documentation index at: https://atmet.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate and Manage Atmet API Keys for Your Workspace

> Create, use, and revoke Atmet API keys to authenticate programmatic access to your workspace from scripts, apps, and CI/CD pipelines.

API keys let you authenticate requests to the Atmet API from your own scripts, applications, or CI/CD pipelines — without using your personal login credentials. Each key is scoped to a specific workspace and carries the permissions of the member who created it.

## Key Format

Every Atmet API key starts with the prefix `atmet_` followed by 40 lowercase hexadecimal characters:

```
atmet_a3f8b2c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9
```

Your credentials are stored securely and never exposed after creation. This means **you must copy the key at the moment it is created**. It cannot be retrieved later.

## Create an API Key

<Steps>
  <Step title="Open API Keys settings">
    Navigate to **Settings → API Keys** in the left sidebar.
  </Step>

  <Step title="Click New Key">
    Click **New API Key** in the top-right corner.
  </Step>

  <Step title="Name your key">
    Enter a descriptive name that identifies what this key is used for — for example, `GitHub Actions Deploy` or `Local Dev Script`. Good names make it easier to audit and rotate keys later.
  </Step>

  <Step title="Set an optional expiry date">
    If you want the key to stop working automatically after a certain date, select an **Expiration Date**. Leave this blank for a non-expiring key.
  </Step>

  <Step title="Copy the key immediately">
    After clicking **Create**, Atmet displays the full raw key exactly once. Copy it to a secure location — a password manager or secrets vault — before closing the dialog.
  </Step>
</Steps>

<Warning>
  The raw API key is shown **only once** at creation time. If you close the dialog without copying the key, you must revoke it and generate a new one. Atmet cannot display or recover the original key.
</Warning>

## Use Your API Key

Pass your API key in the `Authorization` header as a Bearer token on every request. You must also include the `x-workspace-id` header to identify which workspace the request targets.

**cURL example:**

```bash theme={null}
curl https://app.atmetai.com/api/chats \
  -H "Authorization: Bearer atmet_your_key_here" \
  -H "x-workspace-id: your_workspace_id"
```

**TypeScript / JavaScript example:**

```typescript theme={null}
const response = await fetch('https://app.atmetai.com/api/chats', {
  headers: {
    'Authorization': 'Bearer atmet_your_key_here',
    'x-workspace-id': 'your_workspace_id',
  },
});
const { chats } = await response.json();
```

<Tip>
  Store your key in an environment variable (e.g. `ATMET_API_KEY`) rather than hardcoding it in your source files. Read it at runtime with `process.env.ATMET_API_KEY` in Node.js or the equivalent in your language of choice.
</Tip>

## Manage Existing Keys

The **Settings → API Keys** page lists all keys created in the workspace, showing:

| Field         | Description                                              |
| ------------- | -------------------------------------------------------- |
| **Name**      | The label you gave the key when you created it           |
| **Created**   | The date the key was generated                           |
| **Last Used** | The last time the key was used to authenticate a request |
| **Expires**   | The expiry date, or "Never" if no expiry was set         |

<Note>
  The raw key value is never shown in the list. Only the metadata above is displayed to protect your credentials.
</Note>

## Revoke a Key

Revoking a key immediately invalidates it. Any requests using that key will receive a `401 Unauthorized` response.

<Steps>
  <Step title="Open Settings → API Keys">
    Navigate to the API Keys list.
  </Step>

  <Step title="Find the key to revoke">
    Locate the key by name or creation date.
  </Step>

  <Step title="Click Revoke">
    Click the **⋯** menu next to the key and select **Revoke**. Confirm the action in the dialog.
  </Step>
</Steps>

## Security Best Practices

Treat API keys like passwords. Follow these practices to keep your workspace secure.

<CardGroup cols={2}>
  <Card title="Never commit keys to source control" icon="code-branch" href="workspace/api-keys">
    Use environment variables or a secrets manager. Add `.env` to your `.gitignore` to prevent accidental commits.
  </Card>

  <Card title="Set expiry dates" icon="calendar-xmark" href="workspace/api-keys">
    Short-lived keys reduce the blast radius if a key is ever leaked. Set expiry dates for all keys used in automated pipelines.
  </Card>

  <Card title="Rotate keys regularly" icon="arrows-rotate" href="workspace/api-keys">
    Create a new key, update your application to use it, and revoke the old key on a regular schedule — at minimum every 90 days.
  </Card>

  <Card title="Use one key per application" icon="key" href="workspace/api-keys">
    Create separate keys for each script or service. If one is compromised, you can revoke it without affecting other integrations.
  </Card>
</CardGroup>