> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ingestly.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create and manage API keys for programmatic access to Ingestly.

API keys let you authenticate programmatic requests to the Ingestly API, such as triggering pipelines via the [webhook trigger](/guides/webhook-trigger).

## Creating an API key

1. Go to **Settings** → **API keys**
2. Click **New API Key**
3. Enter a descriptive name (for example, "Production integration")
4. Optionally set an **expiration date**. The key will automatically stop working after this date. If left blank, the key does not expire
5. Click **Create**
6. **Copy the key immediately:** it is only shown once

<Warning>Store your API key securely. You cannot retrieve the full key after creation. If you lose it, you must create a new one.</Warning>

## Key format

API keys use the `ing_` prefix followed by a unique identifier:

```
ing_a1b2c3d4e5f6g7h8i9j0...
```

## Using your API key

Include the key in the `X-Api-Key` header of your API requests:

```bash theme={null}
curl -X POST "https://api.ingestly.ai/pipelines/{pipelineId}/trigger" \
  -H "X-Api-Key: ing_your_api_key_here" \
  -F "file=@document.pdf"
```

See the [authentication guide](/api-reference/authentication) for more details.

## Key scope

API keys are scoped to your **organization**. A key can access any pipeline in the organization that has a webhook trigger configured. The key carries the `ApiKeyAuth.Trigger.Create` permission, allowing it to submit documents to any active pipeline's webhook trigger.

## Managing keys

### Deactivating a key

Deactivate a key to temporarily disable it without deleting it. Requests using a deactivated key receive a `401` error.

### Deleting a key

Delete a key to permanently revoke it. This action cannot be undone.

## Security best practices

* **Rotate keys regularly:** create a new key, update your integrations, then delete the old key
* **Use descriptive names:** name keys after their purpose (for example, "CI/CD pipeline", "Production app")
* **Never commit keys to source control:** use environment variables or a secrets manager
* **Delete unused keys:** remove keys that are no longer in use
* **Monitor usage:** review your runs to detect unexpected API activity