> ## Documentation Index
> Fetch the complete documentation index at: https://paperlinkai.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create, rotate and revoke the key that connects the widget on your site to your bot.

An API key tells Paperlink AI which bot a widget belongs to. You put the key in your page, so it is public by design.

> [!NOTE]
>
> Keys you create in the dashboard start with `pl_live_`. The key is meant to be public: it sits in your page's HTML. Allowed origins, Turnstile and rate limits are what protect it.

## What a key can do

A key only authenticates the widget. Keys have no scopes. Only Admins can create, rotate and revoke keys.

## Create a key

You create keys in the dashboard, in the API keys and embed card on the Settings page. Enter a key name, for example "Production site", and select **Create key**. The default name is "Widget key".

The dashboard shows the full key one time. Copy it and store it in a safe place. If you lose a key, rotate it.

Your workspace can have up to 20 active keys.

## Rotate a key

Rotation makes a new key with the same name. The old key keeps working for 10 more minutes, so you have time to deploy the new key.

To stop the old key at once, select the checkbox "Revoke the current key immediately (use this if it leaked)".

## Revoke a key

> [!WARNING]
>
> A revoked key cannot be restored, and every widget that uses it stops answering. Rotate the key first if the widget must keep working.

A revoked key cannot be restored. The key can take about 60 seconds to stop working everywhere.

## If a key leaks

**1. Rotate the key and revoke the old one**

Rotate the key and select the checkbox "Revoke the current key immediately (use this if it leaked)". The old key stops working in about 60 seconds. The widget stops answering until the new key is deployed.

**2. Deploy the new key**

Put the new key in your site.

**3. Check your allowed origins**

Open Settings and check the Allowed origins list. Only your own sites must be on it. An empty list allows any site.

**4. Watch Conversations**

Open Conversations and look for questions that you do not expect. Set the Source filter to Widget to see widget traffic.

> **[Allowed origins, Turnstile and rate limits](https://paperlinkai.com/docs/developers/security/allowed-origins-and-turnstile.md)**
>
> Learn how the three protection layers work together.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.