Managing keys: copy / test / disable / delete

How to read the key list

The "API Keys" page lists all your keys:

• Name: an identifier for the purpose
• Status: enabled / disabled
• Group: the service group it is bound to
• Usage: quota consumed
• Created at: for easier tracking

Copying a key

WARNING

The list page does not show the key itself (for security reasons). Situations where you need the key itself:

• The key itself, saved right after creation
• Or delete it and create a new key

The "Copy" button copies the key identifier (used to fill in the client), but the key itself is only shown once, at creation time. If you forgot the key itself, the safest approach is to delete it and create a new one.

Testing a key

Some client configuration pages support "Test": after you enter the key, a test message is sent to quickly verify whether the key works with the current group/model.

Disabling a key

• Disable: temporarily deactivate it; the key stops working immediately and calls return 401; you can re-enable it at any time
• Good for: limiting the damage when you suspect a leak, temporarily restricting a device

Deleting a key

• Delete: removes it permanently and irreversibly; every client using that key stops working
• Good for: a confirmed key leak, retiring a device, an abandoned purpose

When to disable/delete immediately

• The key was posted to a public repository / leaked in a chat screenshot
• Abnormal calls appear from an unfamiliar IP (you can check the source in the usage records)
• A device is lost or resold

Best practices

1. Split keys by purpose: don't share one key across all devices
2. Clean up regularly: delete abandoned keys in time
3. Create few high-quota keys: use the highest-privilege key only on your own main device
4. Combine with limits: set quota/rate/expiry limits for shared devices, see Key limits