> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloud.aptranet.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create, scope, rotate, disable, and delete project API credentials.

Each API key belongs to one project and contains an access key, a secret, a status, and explicit permissions. API keys are for server-side automation, not browser sessions.

## Create a key

**1. Select the project**

Use the project selector before opening **Developers**. The selected project becomes the key's permanent resource scope.

**2. Name and scope the key**

Use a name that identifies the workload and environment, such as `production-dns-deployer`. Enable only the actions the workload performs.

**3. Store both credentials**

Save the `APTRANET_…` access key and secret in a secret manager. The secret is shown only after creation or rotation.

## Authenticate

```bash theme={null}
curl https://api.aptranet.com/cloud-dns/zones \
  --header "Authorization: Bearer APTRANET_REPLACE_WITH_ACCESS_KEY" \
  --header "Aptranet-Secret: REPLACE_WITH_SECRET"
```

The access key is sent as a bearer credential. The secret is sent separately in `Aptranet-Secret`. Both are required.

## Credential lifecycle

| Action | Effect |
| - | - |
| Roll secret | Invalidates the previous secret and returns a replacement |
| Disable | Keeps the key record but prevents authentication |
| Enable | Allows a valid key and secret to authenticate again |
| Delete | Permanently removes the key |

> [!WARNING]
>
> Secret rotation is immediate. Update consumers before or as part of the roll. Aptranet currently returns one active secret per key, so plan a coordinated deployment or create a replacement key for overlap.

See [API authentication](/api-reference/authentication) and [API permissions](/api-reference/permissions) for request details.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.