> For the complete documentation index, see [llms.txt](https://docs.cloud.olakrutrim.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloud.olakrutrim.com/basics/key-management-system/model-api-keys.md).

# API Keys

Create and manage API keys for Sandbox, MCP, Models, CLI, and SDK.

Create and manage general Krutrim Cloud API keys for Sandbox, MCP, Models, CLI, and SDK. API keys are no longer model-specific, and creating a key does not require selecting a model or model group.

A key authenticates supported requests; it does not bypass account permissions or service access requirements. Follow the authentication instructions for the service or client you use.

## Create an API key

{% stepper %}
{% step %}

### Open API keys

Sign in to the [Krutrim Cloud Console](https://cloud.olakrutrim.com/console/inference-service?section=api-keys) and go to **Administration → API keys.**
{% endstep %}

{% step %}

### Name your key

Click Create API Key. In the Create New API Key dialog, enter a descriptive Secret Name, such as `production-app`, `sandbox-dev`, or `mcp-local`. These are example names, not secret values.
{% endstep %}

{% step %}

### Create and store securely

Click Create API Key to generate the key. Copy and store the secret securely when displayed; do not rely on recovering it later. Use a secret manager or private environment configuration.
{% endstep %}
{% endstepper %}

## Use your key

* **Sandbox, Models, and other supported APIs:** Follow the service guide for the endpoint, authentication header, and request format. Model inference is one use of a general API key, not its scope limit.
* **MCP:** Set the raw key privately as `KRUTRIM_API_KEY`, without a `Bearer` prefix or surrounding spaces. Restart the client after changing the key. See the [MCP Overview](/mcp/overview.md) for setup and client connections.
* **CLI and SDK:** Configure the key using the credential settings documented for your client. Keep it out of shared configuration files and source control.

General API keys do not replace SSH keys used to access virtual machines or the public/private credentials used for bucket access. Follow those separate credential guides when connecting to VMs or storage.

## Manage and revoke keys

Return to **Administration → API keys** to find a key by name using Search API keys. The table shows Name, Secret Key, Created At, and Actions. Use descriptive names to identify which application or environment depends on each key.

### Replace a key safely

1. Create a replacement key and store it securely.
2. Update every application, MCP client, CLI, or SDK configuration that uses the old key.
3. Restart or reload the affected clients as needed and verify that they work with the replacement.
4. Locate the exact old key in the table, open its Actions menu, and choose Delete to revoke it.

{% hint style="warning" %}
Deleting a key can interrupt every application that still uses it. Verify the exact key before deletion. If a key is exposed, revoke it promptly, replace it, and update affected clients.
{% endhint %}

## Keep keys private

* Use separate keys for production, testing, and individual integrations where practical.
* Store secrets in a secret manager or private environment configuration; never hard-code them.
* Never put API keys in agent prompts, screenshots, logs, shared documents, or source control.