> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ravan.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Understand what API keys are, how Agni uses them, and how developers should handle them securely.

An API key is a secret token that identifies your organization when your app calls the Agni API.\
Think of it like a password for server-to-server access.

***

## What is an API key

* It proves the request is coming from your Agni workspace.
* It controls access to protected API endpoints.
* It should only be used in trusted backend environments.

<Warning>
  Never put your API key in frontend code, public Git repositories, or client-side apps.
</Warning>

***

## Where to get your API key

1. Sign in to `https://app.ravan.ai`.
2. Open **Settings**.
3. Go to **Security & Access** > **API Keys**.
4. Click **+ New Key**.
5. Copy it immediately and store it securely.

<Frame>
  <img src="https://mintcdn.com/agni/wGEXRTXXwORCEgLm/images/settings-api-keys.png?fit=max&auto=format&n=wGEXRTXXwORCEgLm&q=85&s=e955e34f55103ba7c8c385c1645500c0" alt="Settings page showing the Security and Access API Keys section" width="1277" height="923" data-path="images/settings-api-keys.png" />
</Frame>

<Note>
  You can only view a newly generated key once.
</Note>

***

## How Agni uses your API key

Send your key in the `X-Api-Key` header on every API request.

```bash theme={null}
curl https://api.ravan.ai/api/v1/agents/ \
  -H "X-Api-Key: YOUR_API_KEY"
```

If the key is missing, invalid, or revoked, the API returns `401 Unauthorized`.

***

## Developer implementation guide

Use your API key only on the server side, and inject it from environment variables.

```bash theme={null}
# .env
AGNI_API_KEY=your_real_key_here
```

```js theme={null}
const response = await fetch("https://api.ravan.ai/api/v1/agents/", {
  method: "GET",
  headers: {
    "X-Api-Key": process.env.AGNI_API_KEY
  }
});
```

***

## Security best practices

* Rotate keys regularly.
* Use separate keys for staging and production.
* Revoke compromised keys immediately.
* Do not share keys in chat, tickets, or screenshots.
* Audit logs when you see unexpected API behavior.

***

## Troubleshooting

If requests fail with `401`:

* Confirm the header name is exactly `X-Api-Key`.
* Check there are no extra spaces in the key value.
* Ensure you are using an active key from the correct workspace.
* Regenerate the key and update your server environment.