> For the complete documentation index, see [llms.txt](https://docs.tylt.money/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tylt.money/introduction/generating-api-keys.md).

# Generating API Keys

<figure><img src="/files/oaUWIw1RZsPR5TKg6N2G" alt=""><figcaption></figcaption></figure>

#### **Introduction**

To use the Tylt API, you must generate a pair of credentials: an API Key and a Secret Key. API credentials are issued per service. Each enabled service has its own unique set of API keys and must be generated separately.

***

#### **Generating API Keys**

1. Navigate to Settings → API Keys in your Tylt Dashboard
2. Select the relevant service
3. Click Generate Key

A new set of credentials will then be issued for that service:

* **API Key:** Used in the `Authorization` header of API requests to identify your account and service.
* **Secret Key:** Used to generate HMAC-SHA256 signatures for request authentication and webhook verification. This key must be kept confidential and must never be exposed in client-side code.

***

#### **Important Notes**

* Each service has its own separate API Key and Secret Key
* API keys are environment-specific (Demo and Production)
* Generating a new key for a service may invalidate the previously issued key for that service
* Secret keys are only visible at the time of creation

***

#### **Storing Your API Keys**

Immediately after generating your API credentials, ensure they are stored securely.

* API and Secret Keys cannot be retrieved after generation
* If lost or compromised, new keys must be regenerated
* Do not store keys in source code or expose them in frontend applications

{% hint style="danger" %}
**Security Requirement:**\
Store API credentials in a secure environment such as a secrets manager or encrypted storage. If you suspect any compromise, regenerate your keys immediately and update all integrations.
{% endhint %}