API keys and projects

Every request is made with an API key, and every key belongs to a project. Projects are how you keep the usage of different apps, teams or environments apart inside one organization: each has its own keys, logs and analytics, and all of them draw on the organization's one balance.

Create a key

Open API keys.
Enter a name that says where the key is used — "Production backend", "Staging", "Claude Code on my laptop".
Choose the project its requests count towards.
Click Create key and copy the secret.

The full secret is shown once, right after creation. Store it in a secret manager or an environment variable then; it can't be shown again. The integration guide has copy-paste examples with your new key.

Each key card shows its project, when it was created, and when it was last used, which makes stale keys easy to spot.

Roll a key

Rolling replaces a key's secret and keeps its name, project and usage history. The old secret stops working at once, so update everything that uses it straight away. Only the person who created a key can roll it.

Roll a key whenever it may have leaked — pasted into a chat, committed to a repository, left in a log.

Delete a key

Deleting a key stops every client using it from authenticating immediately. Its usage history stays in your analytics, labelled as a deleted key.

Each person manages the keys they create. Owners and admins can see and delete everyone's keys in the organization.

When someone is removed from an organization, every key they created there is deleted with them.

Projects

Every organization starts with a project called default. Add more in project settings, and switch between them with the project selector in the console's sidebar; the keys, logs and analytics pages show the selected project.

Rename a project at any time; its keys keep working.
Owners and admins can delete a project. An organization always keeps at least one.
A good split is one project per product and environment: web-production, web-staging, internal-tools.

Good practice

One key per app, environment and person. A leak then means rolling one key, not all of them.
Keep keys on servers. Never ship a key in a browser bundle or mobile app.
Delete keys that haven't been used in months.