# API keys

> Create and manage the keys that authenticate calls to the Runbear API.

Source: https://docs.runbear.io/api/api-keys

Last updated: 2026-08-26

A Runbear API key authenticates requests to the [REST API](https://api.runbear.io/v1/docs)
as your organization. Every endpoint outside the browser SDK's session flow expects
one as a bearer token.

## Creating a key

Open **Settings** and select **API Keys**, then **Create API key**. Name it after
the system that will use it, such as `Acme Corp integration`, so an unfamiliar key
in a log can be traced back to its owner.

The key is shown once. Store it in your secret manager immediately.

> **Warning**
>
> An API key is an organization-level credential. Anyone holding it can act as your
> organization. Never ship one in browser JavaScript, a mobile app, or a public
> repository. To put an agent in a web page, use the
> [Web SDK's session mode](/api/web-sdk.md#session-mode), which keeps the key on your
> server.

## Revoking

Revoking a key takes effect immediately and cannot be undone. Requests using it
begin failing with `401`, so rotate the consumer first when replacing a key that is
in use.

## Related

- [Web SDK](/api/web-sdk.md) — embed an agent without exposing a key
- [MCP server](/api/mcp-server.md) — manage agents from an AI client, authenticated by OAuth rather than a key
- [Traces API](/api/traces.md)