Source: https://databento.com/docs/portal/api-keys


# API keys

![API Keys](https://databento.com/docs/api-keys-0.png)

### Overview

An **API key** is an authentication key generated by our API to identify the source making a
request to the Databento platform.

API keys add a layer of security to your account. With them, you can authenticate data requests
without using your account username or password. You can also assign specific permissions to team
members and limit data access. Protect your API key like your password--never give it to a third
party.

There is a limit of 100 API Keys on your account. If the maximum number of keys is reached, a `403`
error status will be returned when attempting to create a new key.

### Creating an API key

  1. Click the **Create a new key** button.
  2. Provide a descriptive name for your API key (API key names must be unique, and up to
     **64 characters long**).
  3. Click on the **Create** button.

### Editing an API key

  1. Click on the pencil icon for the key you want to edit.
  2. Type a new name for the API key.
  3. Click on the **Save** button.

### Rotating an API key

We recommend that you regularly rotate all API keys for security reasons. This limits the time any
one key is active, reducing potential billing impact if a key becomes compromised. See the end of
this guide for other best practices to [secure your API keys](https://databento.com/docs/portal/api-keys.md#securing-your-api-keys).

  1. Click on the rotate icon for the key you want to rotate.
  2. Click on the **Rotate** button to confirm.
  > **Note**: Any live applications currently using the API key will be disconnected.

### Deleting an API key

  1. Click on the trash can icon for the key you want to delete.
  2. Click on the **Delete** button to confirm.
  > **Note**: Before you delete a key, we recommend you first test that it's no longer in use.

### Copying an API key

  1. Click on the copy icon for the key you want to copy. The API key has now been copied to
     your clipboard.

### Securing your API keys

Since API keys are used to authenticate requests, it's important to secure them. If your API key
is exposed and used to access data, your account will incur billing charges. Aside from regularly
changing your API keys, here are some best practices to keep them secure:

- **Don't store your API keys within source code under version control.** Instead, we recommend setting your API keys as environment variables. If you need to store an API key in a file, it's advised to store it in an `.env` file that's read at runtime.
- **Regenerate any API key that may have been compromised.** If you have reason to believe that an API key has been compromised, delete it immediately. You can create a new one in your Databento portal.
- **Use a different API key for each application.** This allows you to isolate incidents and regenerate the key for one application without affecting others.
- **Turn on historical usage limits.** Users with a compromised API key are liable for any unauthorized charges. For additional protection against misuse, you can [set up usage limits](https://databento.com/docs/portal/billing.md#manage-historical-monthly-limit) in your Databento portal. These limits can't be adjusted via API.

### Revoked API key

Your account security is important to us. If we find that an API key has been made public, whether
on GitHub, in our Slack community, or elsewhere, we'll revoke the key to protect your account. A
revoked API key can't be used for authentication, so to remedy this, rotate the revoked key or
create a new key.