# API keys

> Create, limit, turn off and safely store Vikey API keys.

An API key is what apps and coding agents use to call Vikey. All keys of one account share the same balance.

## Creating a key

Open **API Keys** in the dashboard and create a new key. Give it a clear name, such as `work-laptop` or `telegram-bot`, so its usage is easy to tell apart.

Create a separate key for each machine or app. If one key leaks, you only turn that key off without affecting the others.

## Per-key settings

| Setting | Purpose |
| --- | --- |
| Usage limit | Optional. Limits the number of requests for this key. |
| Active or inactive | An inactive key is rejected right away with `403`, without deleting it. Turn it back on any time. |
| Hide provider name | `GET /v1/models` shows short names such as `claude-sonnet-5.5`. See [Choosing a model](/en/models/choosing/#hiding-the-provider-name). |

## Keeping keys safe

- Keep the key in an environment variable such as `VIKEY_API_KEY`, not in code.
- Never commit a key to a repository. For Claude Code, use `~/.claude/settings.json` or `.claude/settings.local.json`, not a project's `.claude/settings.json`.
- Never put a key in a frontend or mobile app. Call Vikey from your server.

**Key leaked?**

Turn that key off in **API Keys**, create a new one, and replace it everywhere it is used. Check **Usage** for activity you do not recognize.

Source: https://docs.vikey.ai/en/account/api-keys/