> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chattler.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Get your API key

> Create, rotate and delete keys on the agent's Integrations page.

Keys are managed in the Chattler app, on the agent's **Integrations** page, in the **API access** card ("Доступ по API"). No API call creates a key.

## Create a key

<Steps>
  <Step title="Open the agent">
    In the app, open the agent you want to expose and go to its **Integrations** page.
  </Step>

  <Step title="Add a key in the API access card">
    Give the key a name and choose its permission:

    * `read-only`: list conversations and read messages.
    * `full`: everything above, plus the chat endpoints.
  </Step>

  <Step title="Copy the key now">
    The raw key is shown **once**, right after creation. It looks like this:

    ```text theme={null}
    cht_live_<key_id>.<secret>
    ```

    Only the secret part authenticates. The `key_id` part is public and is the key's id everywhere in the dashboard. If you lose the secret, rotate the key.
  </Step>
</Steps>

## Rotate a key

Rotation issues a new secret and invalidates the old one immediately. The key id, its conversations and its statistics stay attached to the same key, so rotation is the right answer to a suspected leak: nothing else changes.

## Delete a key

Deleting a key removes it. From that moment every request with it fails with `401 invalid_api_key`, indistinguishable from a key that never existed. Its conversations and request history stay readable in the dashboard. Deletion cannot be undone; create a new key instead.

<Warning>
  **Never ship a key in a browser bundle, a mobile app or any client you do not control.** A key is a long-lived owner credential that spends the owner's balance. Call the API from your own backend and rotate the key the moment you suspect it leaked.
</Warning>

## Authenticate with the key

Only the `Authorization` header with the `Bearer` scheme is accepted. Query-string credentials are ignored, and no dashboard token or `Browser-ID` header is involved.

```http theme={null}
Authorization: Bearer cht_live_<key_id>.<secret>
```

A key is bound to one agent. Using it against a different `{agent_id}` returns `403 agent_mismatch`.

## Statistics

Usage is not shown in the API access card. Open the agent's **Statistics** page ("Статистика") and pick the key in the **Integration** filter; each key is listed there as its own integration. The page then shows, per key and per UTC day, the request count, successful and failed requests, error rate, average and p95 latency, unique users, active conversations, tokens and the amount charged, plus breakdowns by endpoint, HTTP status and error code. Provider cost is never exposed; the amount shown is what was charged to the balance.