Platform
API key
An API key is the secret string that authenticates a program against an API, sent as a bearer token on every request. It identifies the account paying for the call.
A key is a credential, not a config value: it belongs in an environment variable on a server, never in client-side code or a committed file, because anyone holding it can spend against your balance.
Rotating keys is routine rather than an emergency measure — separate keys per environment mean revoking one never takes the others down.
On eroq
Keys are created in the dashboard and shown once. They belong to the workspace and spend from its shared wallet, and each one inherits the role of the member who holds it — demote that member and their keys stop generating. The plan caps how many exist at a time, from 3 on a free workspace to 200 on Agency.
Questions
Where should I put my key?
In a server-side environment variable. A key in browser code or a public repository is spendable by anyone who finds it, so treat a leak as a revocation rather than a warning.
Can I see a key again after creating it?
No — it is shown once at creation. If you lose it, revoke it and create another; the ledger keeps the usage history either way.
Do keys have their own permissions?
They inherit the role of the member who created them, so a Viewer's key cannot generate and a Developer's can. Changing that member's role changes what their keys can do.