> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbitrage.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Mint, scope, and revoke the keys that authenticate your traffic.

Every request to the gateway is authenticated with an Orbitrage API key. Keys
are **workflow-scoped** — each key belongs to exactly one project, which is how
your calls get attributed without passing anything extra.

## Key format

```
orb_<8-hex-prefix>_<32-hex-secret>
```

The prefix is indexed for fast lookup; the full key is verified against a stored
**SHA-256 hash**. The plaintext is shown **once** at creation and never stored —
if you lose it, revoke and mint a new one.

## Mint a key

<Steps>
  <Step title="Create a project">
    On the [Keys page](https://app.orbitrage.ai/keys) (or **Workflows**), create
    a project. A default key is minted with it.
  </Step>

  <Step title="Copy the key">
    The plaintext appears once. Store it in your secret manager or environment:

    ```bash theme={null}
    export ORBITRAGE_API_KEY=orb_a1b2c3d4_e5f6...
    ```
  </Step>

  <Step title="Use it">
    Pass it to the SDK (`orbitrage.init(key)`) or as `Authorization: Bearer …`
    on direct HTTP calls.
  </Step>
</Steps>

You can mint additional keys for the same project at any time.

## List & revoke

* The **Keys** page lists active keys with their prefix, last-4, created date,
  last-used time, and owning project.
* **Revoke** is a soft delete — the key stops working immediately, and the row is
  kept for audit. Any integration using it will start getting `401`.

<Warning>
  Revocation is visible to the gateway within \~5 minutes (the key-resolution
  cache TTL). For an immediate cutover, rotate the integration to a new key.
</Warning>

## How a key maps to your data

| The key carries  | Used for                                    |
| ---------------- | ------------------------------------------- |
| **Organization** | Billing, credit gating, and RLS isolation.  |
| **Workflow**     | Which project your calls are attributed to. |
| **User**         | The account that created the key.           |

You don't pass an org or workflow id on requests — the key implies both. To
attribute calls to *your* end-users, add the `x-orbitrage-end-user-id` header
(the SDK's `user_id` / `userId` does this). See
[Observability](/concepts/observability#per-end-user-attribution).

## Other key types

* **MCP keys** (`mcp_…`) authenticate the [MCP server](/platform/mcp) only —
  a separate namespace from router keys.
* **BYOK provider keys** are your own OpenAI/Anthropic/Google/xAI keys, stored
  encrypted so Orbitrage can forward matching calls to the real provider. They are
  **required** for the closed frontier chat models (`claude-*`, `gpt-*`,
  `gemini-*`, `grok-*`) and are billed by your provider, not by Orbitrage. See
  [BYOK](/concepts/byok).