# API Keys (/docs/dashboard/api-keys)



**API Keys** (sidebar → Current Project → API Keys) holds the SDK keys for one project. Each key
authenticates your app so TokenPolice knows whose spending it is looking at.

## What it's for [#what-its-for]

One key per app or environment. The page's own description: *"These keys are used to authenticate
your application with the TokenPolice Analytics Collector... The full key is shown only once at
creation — store it securely, and replace it if you lose it."*

## The table [#the-table]

| Column      | Shows                                                          |
| ----------- | -------------------------------------------------------------- |
| **Name**    | The name you gave the key.                                     |
| **API Key** | A masked value — the prefix and last four characters only.     |
| **Created** | When it was issued. Newest first.                              |
| **Actions** | **Replace** (issue a new key, revoke this one) and **Delete**. |

## Creating one [#creating-one]

<Steps>
  <Step>
    Click **Generate Key**. A modal opens titled **New API Key**.
  </Step>

  <Step>
    Type a **Key Name** — something like *Production Web App*. The button stays disabled until you do.
  </Step>

  <Step>
    Click **Generate Key*&#x2A; again. The full key appears once: &#x2A;"Copy this key now. For your security,
    it will not be shown again."* Dismiss with **I've saved the key**.
  </Step>
</Steps>

Keys look like `tp_sk_...` and are 77 characters long. We store only a hash of it plus the masked
prefix and last four, so **there is no key recovery** — if you lose one, replace it.

## Replace and delete [#replace-and-delete]

* **Replace*&#x2A; revokes the current key and issues a new one with the same name, in one step. The
  dashboard warns: &#x2A;"Any application still using the old key will stop sending analytics until you
  update it with the new key."*
* **Delete*&#x2A; removes the key outright: &#x2A;"If this key is being used in your application, token
  analytics and budget enforcement will stop working immediately."*

<Callout type="warn">
  Revocation takes effect near-instantly. An app still holding a revoked key keeps running — the
  SDK is [fail-open](/docs/concepts/fail-open), so your users see nothing — but it stops reporting
  spend, and your rules stop seeing its traffic. Deploy the new key before, or immediately after,
  you replace.
</Callout>

Creating, replacing and deleting are admin-only; any member can view the list.

## Using the key [#using-the-key]

Set both values in your app's environment:

```bash
TOKENPOLICE_API_KEY=tp_sk_...
TOKENPOLICE_BASE_URL=https://collect.tokenpolice.ai
```

## What to look for [#what-to-look-for]

* **No rows at all** — your app can't be reporting. Create one, or check
  [Get started](/docs/dashboard/get-started).
* **Traffic stopped after a replace** — something is still on the old key. Search your deploys and
  local `.env` files for the old prefix.
* **A key you don't recognise** — delete it; every key create and revoke also arrives as an
  account notification.

## Next [#next]

<Cards>
  <Card title="Get started" href="/docs/dashboard/get-started" description="Where your first key is created, with the .env block beside it." />

  <Card title="tp.init" href="/docs/sdk/init" description="Where the key and base URL go in code." />

  <Card title="Data privacy" href="/docs/concepts/data-privacy" description="What the SDK sends with that key — and what it never sends." />
</Cards>