Open **API keys** in the sidebar. It needs the `api-keys:manage` permission, so an account without it will not see the menu.

## Create a key

1. Choose to create a key and name it after what will use it, for example `undrly-ss-apikey`. One key per integration means revoking one never breaks another.

   ![](https://app.chatwoot.com/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBCTkRMUGdjPSIsImV4cCI6bnVsbCwicHVyIjoiYmxvYl9pZCJ9fQ==--f141e8b71921e080b629ad7e6c1aae4e9400deaa/Screenshot%202026-10-25%20at%2012.51.57.png)

2. Pick the kind:

   * **Secret** (`sk_…`) for your server. Tick only the permissions it needs.

   * **Publishable** (`pk_…`) for browser code. It has a fixed, limited reach.

3. Copy the secret from the dialog straight away.

   ![](https://app.chatwoot.com/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBCS2JNUGdjPSIsImV4cCI6bnVsbCwicHVyIjoiYmxvYl9pZCJ9fQ==--7f43b6b4b2b7c59d28b740d695c81e49ae9a149b/Screenshot%202026-10-25%20at%2012.53.28.png)

The secret is shown **once**. Mayarin stores only a hash and cannot show it again. Lost it? Make a new key and deactivate the old one.

## Keep it safe

* Never put an `sk_` key in a web page, theme file, chat message or public repository.

* Testnet and mainnet keys are separate. A testnet key is refused on mainnet.

## If a key leaks

Deactivate it under **API keys**. It stops working on the next request. Deactivation cannot be undone, so create the replacement and deploy it first if the integration is live.

Developers: see [authentication and key safety](https://docs.mayarin.xyz/guides/authentication).