# Create an API key

Create an environment-specific API key with the permissions and expiry your backend needs. You need access to API keys in the intended workspace.

> **Before you start**
>
> Choose the workspace and whether you need a key for sandbox testing or production requests. Decide whether your application needs read-only access or both read and write access. Keep the key in a server-side secret manager; never put it in browser code, source control or screenshots.

## Step 1: Open API keys

In **Developer portal**, open **API keys**. The **Mock API keys** section is for sandbox testing; use **Production API keys** for production requests. Create separate keys for these purposes.

## Step 2: Set the key’s access and expiry

Choose **Generate new API key** for the intended environment. Enter a label you can recognize later, such as “Acme Trading — sandbox invoices”. Select **Read** if the application only retrieves information. Select **Write** as well if it submits invoices or changes data. Choose how long the key lasts: **7 days**, **30 days**, **90 days**, **180 days** or **365 days**, or **Custom date** for a date up to two years ahead. **90 days** is selected when the dialog opens. Note the expiry date and replace the key before it.

## Step 3: Copy the secret

Create the key, then copy the full secret from the dialog into your server-side secret manager. **It is shown only once.** The key appears in the API keys list afterward, but the list does not reveal the secret again. If you close the dialog without saving it, revoke the key and create a replacement.

## Use or replace the key

The authentication header depends on the API you call. See [Authentication and environments](https://docs.complyance.io/api-reference/authentication/) for the header names and the way each request selects sandbox or production. Never send both authentication headers in one request.

To replace an exposed or unneeded key, generate and deploy a replacement first, then choose **Revoke** on the old key and confirm. Revoked and expired keys cannot authenticate. Do not share a key in a support request.

## Limits

| Limit | Value |
| - | - |
| Active production keys per workspace | 25 |
| Active mock keys per workspace | 50 |
| Key lifetime | 1 day to 2 years |
| Label length | 100 characters |

Each section shows how many active keys it has against its limit. When a section is full, creating a key shows `The active API key limit has been reached.` Revoke a key you no longer use, then try again.

## If something goes wrong

**You cannot open API keys:** confirm the selected workspace and ask a workspace administrator to check your access.

**The request returns `401`:** check that you copied the full secret, use the authentication header required by that API, and check whether the key is expired or revoked. Create a replacement if needed.

**The request returns `403`:** check the key’s permissions and environment against the operation. A sandbox key cannot authorize a production request. Create a key with the required access instead of changing the request to bypass the restriction.

Next, [create an integration](https://docs.complyance.io/one-platform/developer-portal/integration-engine/create/) with a sandbox sample payload.

Source: https://docs.complyance.io/one-platform/developer-portal/api-keys/