> ## Documentation Index
> Fetch the complete documentation index at: https://docs.callem.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Generate and manage API keys for programmatic access to Callem Studio data.

# API Keys

API keys allow you to access Callem Studio data programmatically via the [Public REST API](/api-reference/introduction). Use them to integrate call data and knowledge base content into your own systems.

## Accessing API Keys

Navigate to **Settings** from the sidebar, then select the **API Keys** tab.

## Creating an API Key

1. Click **Create API Key**
2. Enter a descriptive name (e.g. "Production CRM Integration")
3. Optionally configure:
   * **Allowed IPs**: restrict which IP addresses can use this key
   * **Expiration**: set an automatic expiry date
4. Click **Create Key**

<Warning>
  The full API key is displayed **only once** after creation. Copy it immediately and store it securely. You will not be able to see it again.
</Warning>

## Key Format

API keys follow the format: `ck_live_` followed by a random string.

```
ck_live_••••••••••••••••••••••••••••••••
```

Only the first 12 characters (prefix) are stored and displayed in the dashboard for identification purposes. The full key is hashed with SHA-256 and never stored in plain text.

## IP Restrictions

You can restrict API key usage to specific IP addresses for additional security:

| Format     | Example       | Description                            |
| ---------- | ------------- | -------------------------------------- |
| Single IP  | `192.168.1.1` | Allow only this exact IP               |
| CIDR range | `10.0.0.0/24` | Allow an entire subnet                 |
| Wildcard   | `*`           | Allow all IPs (same as no restriction) |

Leave the field empty to allow access from any IP address.

## Key Management

The API Keys list shows:

| Column             | Description                                                     |
| ------------------ | --------------------------------------------------------------- |
| **Name**           | The label you assigned                                          |
| **Key prefix**     | First 12 characters for identification (`ck_live_a1b2••••••••`) |
| **IP restriction** | Number of IP rules, or "All IPs"                                |
| **Last used**      | When the key was last used to make an API call                  |
| **Expires**        | Expiration date, or "Never"                                     |

## Revoking a Key

Click the menu icon next to a key and select **Revoke Key**. This is immediate — any application using this key will lose access instantly.

<Warning>
  Revoking a key cannot be undone. You will need to create a new key and update all applications that used the old one.
</Warning>

## Security Best Practices

<AccordionGroup>
  <Accordion title="Use IP restrictions in production">
    Always restrict API keys to your server's IP address in production. This prevents unauthorized access even if the key is leaked.
  </Accordion>

  <Accordion title="Rotate keys periodically">
    Create new keys and revoke old ones on a regular schedule (e.g. every 90 days).
  </Accordion>

  <Accordion title="Use separate keys per environment">
    Create different keys for development, staging, and production. This makes revocation safer — you can revoke a compromised dev key without affecting production.
  </Accordion>

  <Accordion title="Never commit keys to version control">
    Store API keys in environment variables or a secrets manager. Never hardcode them in source code.
  </Accordion>
</AccordionGroup>