> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ariacompute.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create, rotate, and revoke your API keys

> Step-by-step guide to creating bfvk API keys in the dashboard, using them against the gateway, rotating them, and revoking exposed keys.

API keys let servers and CLIs call the Aria Compute gateway and download authenticated model bundles. This guide walks you through the full lifecycle: create, use, rotate, and revoke.

<Steps>
  <Step title="Open the API Keys page">
    Sign in and open [/dashboard/api-keys](https://ariacompute.com/dashboard/api-keys) (or the equivalent on `ariacompute.cn`).
  </Step>

  <Step title="Create a key">
    Click **Create**, enter a descriptive name (for example `production`, `ci`, or `laptop`), and submit.

    ```bash theme={null}
    curl -X POST https://ariacompute.com/api/api-keys \
      -H "Authorization: Bearer eyJhbGciOi..." \
      -H "Content-Type: application/json" \
      -d '{"name": "production"}'
    ```

    ```json theme={null}
    {
      "id": "key_01H...",
      "name": "production",
      "key": "bfvk-XXXXXXXXXXXXXXXX",
      "prefix": "bfvk-XXXX",
      "created_at": "2026-09-23T10:00:00Z"
    }
    ```

    <Warning>
      Copy `key` immediately. It is only returned in this response; the dashboard and future `GET /api/api-keys` calls show only the `prefix`.
    </Warning>
  </Step>

  <Step title="Use the key">
    Send the full value as a Bearer token to the gateway or download endpoints.

    ```bash theme={null}
    curl -L -H "Authorization: Bearer bfvk-XXXXXXXXXXXXXXXX" \
      "https://ariacompute.com/api/models/gemma-4-e2b-it/download?quant=int4&sdk=v1.0"
    ```
  </Step>

  <Step title="List keys">
    ```bash theme={null}
    curl -H "Authorization: Bearer eyJhbGciOi..." \
      https://ariacompute.com/api/api-keys
    ```

    Returns each key's `id`, `name`, `prefix`, `created_at`, and `last_used_at`.
  </Step>

  <Step title="Revoke a key">
    ```bash theme={null}
    curl -X DELETE \
      -H "Authorization: Bearer eyJhbGciOi..." \
      https://ariacompute.com/api/api-keys/key_01H...
    ```

    Returns `204 No Content`. The key stops working immediately.
  </Step>
</Steps>

## Rotation

Rotate keys periodically or whenever a key may have been exposed:

1. Create a new key and store it in your secret manager.
2. Deploy the new key alongside the old one.
3. Wait until logs confirm all traffic uses the new key.
4. `DELETE` the old key.

## Per-site keys

API keys are scoped to the site that issued them. If you use both `ariacompute.com` and `ariacompute.cn`, create a key in each dashboard and use them against the matching gateway.

<Tip>
  Give keys meaningful names. A short prefix plus environment (`prod-api`, `staging-worker`) makes revocation obvious.
</Tip>


## Related topics

- [Enable two-factor authentication for your account](/guides/two-factor-auth.md)
- [API keys for gateway and model access](/concepts/api-keys.md)
- [Download Aria model bundles from the registry](/guides/download-models.md)
- [Get started with Aria Compute in minutes](/quickstart.md)
- [POST /api/api-keys — create a new API key](/api-reference/api-keys/create.md)