# Organization API Keys

Source: https://staging-docs.aiand.com/organizations/api-keys/

API keys are the recommended credential for server-to-server use. Each key is scoped to a single organization and automatically resolves that org's billing account on every request — no `X-Org-ID` header needed.

## Key format

All keys start with `sk-` and are shown **once** at creation time. Store them in your secret manager — they can't be retrieved again.

## Creating a key

```bash
curl -X POST https://api.aiand.com/api/v1/keys \
  -H "Authorization: Bearer <jwt>" \
  -H "X-Org-ID: <org-id>" \
  -H "Content-Type: application/json" \
  -d '{"name": "production-server"}'
```

Or use the console: Settings → API Keys → Create.

## Managing keys

| Action | Endpoint |
|--------|----------|
| List keys | `GET /api/v1/keys` |
| Create key | `POST /api/v1/keys` |
| Update key (name, status) | `PATCH /api/v1/keys/{key_id}` |
| Revoke key | `DELETE /api/v1/keys/{key_id}` |

All management endpoints require JWT auth and `X-Org-ID`.

## Rotation

Keys don't auto-expire. Rotate them when:

- A team member with key access leaves.
- A key is exposed (leaked logs, accidental commit).
- Compliance policy requires periodic rotation.

Create the new key first, deploy it, then revoke the old one — this avoids downtime.

<Aside type="caution">
  Keys created by a user **remain valid** after that user is removed from the organization. Rotate keys when off-boarding.
</Aside>