# Your customers' API keys

URL: /products/api/customer-keys · Id: `page:products/api/customer-keys`

> How customers of your API get keys: issued in the Portal, scoped to Verbs, test or live, rolled without downtime and revoked on the next call.

Every [Customer](/business/nouns/customer) of your API signs its calls with an [API Key](/business/nouns/api-key) your [Startup](/business/nouns/startup) issues. Customers make their own keys in the [Portal](/business/nouns/portal), so key requests never reach your inbox.

## What a customer gets
| In the Portal | What it does |
| --- | --- |
| Keys screen | Make, name, scope, roll and revoke keys, with each key's last use |
| `test` and `live` keys | A `test` key reaches test records and moves no money |
| Request log | Every call in the last 30 days, with its key, status and the error that names the fix |
| Usage | Calls against each [Limit](/business/nouns/limit) on their plan, with the reset time |

A key carries your brand prefix, such as `leaseline_sk_live_`, ahead of a fixed pattern. Code scanners recognize a leaked key from any Startup with one rule. The full secret shows once, at issue; after that only the prefix does.

## Scope
A key reaches one Customer's [Tenant](/business/nouns/tenant) and nothing else. Its `verbs` narrow it further: a nightly sync key that may call only [`Collection.query`](/business/nouns/collection/query) cannot write, even if the plan allows writes.

A key never reaches past its Customer's plan. Unset `verbs` means every [Verb](/business/nouns/verb) the plan's [Entitlements](/business/nouns/entitlement) grant, and an upgrade widens every such key on the next call.

Tell customers to make one key per job: one for the sync, one for the dashboard, one for each agent. A leak then costs one job, and the request log says which.

## Roll and revoke
| To | Call | What happens |
| --- | --- | --- |
| Replace a key without downtime | [`APIKey.roll`](/business/nouns/api-key/roll) | A new key with the same scope; the old one works until `expireIn`, 24 hours by default |
| Stop a key now | [`APIKey.revoke`](/business/nouns/api-key/revoke) | The next call returns 401 [`unauthorized`](/code/api/errors/unauthorized) |

The platform watches public code and pages for live keys. A leaked key is revoked within minutes, and the Customer's admins get an email to roll a replacement. Your agent can do it for them: [replace a leaked key](/products/api/replace-a-leaked-key).

## Keys for agents
An agent that buys from your API needs no key from a person. It accepts the [Offer](/business/nouns/offer) named in the 402 reply, pays under its own [Mandate](/business/nouns/mandate), and retries the call. [Selling to agents](/products/selling/selling-to-agents) covers the flow.

## Next
- [API plans, limits and uptime](/products/api/plans-and-uptime): what each key's plan allows.
- [Keys](/code/api/guides/keys): the platform's own keys, which your agents and code use.