# API keys

> Use API keys to authenticate server-side requests to Four Echelon. Keys are managed in the dashboard and should never be exposed in client-side code.

Source: https://fourechelon.com/docs/api-keys · Machine-readable: https://fourechelon.com/openapi.json · Index: https://fourechelon.com/llms.txt

## Server-side only

A key is a bearer credential for your account. Anything holding it can spend your budget, so it belongs in a secret manager and in server-side code — never in a browser bundle, a mobile binary, a prompt, or source control.

## Managing keys

Mint and revoke keys from the dashboard. Revocation takes effect immediately. Use separate keys per environment so you can revoke one without taking everything down.

- Keys require an active or trialing subscription
- The secret is shown once, at creation
- Revoked keys fail closed with 401 authentication_error

## If a key leaks

Revoke it first, then mint a replacement. Do not wait to work out how far it spread — revocation is instant and free, and usage on a revoked key stops immediately.