> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agents.labs.bandwidth.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create and manage API keys

> Create a user API key, choose its expiration, and rotate or revoke it from the console.

Sign in to Agent Builder and open **Workspace → API & Developers → API keys**. Your Labs account must have permission to manage Agent Builder API keys. Your workspace role separately determines what the key can do.

## Create a key

1. Select **Create API key**.
2. Enter a descriptive name, such as `Reporting integration`.
3. Choose an expiration: **30 days**, **90 days** (the default), or **365 days**.
4. Create the key and copy the secret while it is displayed. Store it in your integration's secret manager.

The key list shows identifying information and status, not the full secret. Keep the key out of frontend code, source control, screenshots, and logs.

## Select a workspace for requests

Open the **REST API** tab to find the selected **Workspace ID** and request examples. Send that ID in `X-VOAI-ORGANIZATION-ID` alongside your key in `X-BW-LABS-AGENTS-API-KEY`.

Keys belong to your account and can access workspaces where you are currently a member, subject to your role. Creating a key while viewing one workspace does not bind it to that workspace. See [workspaces and permissions](https://docs.agents.labs.bandwidth.com/api-reference/workspaces.md).

## Rotate a key

1. Find the active key and select **Rotate**.
2. Copy the replacement secret and update your integration.
3. Verify a read request with the replacement.
4. Revoke the previous key once all consumers have switched.

Rotation creates a replacement and leaves the previous key active until you revoke it. Inspect the replacement's expiration in the key list rather than assuming a new lifetime.

## Revoke a key

Select **Revoke** and confirm. Requests using that key lose access on their next request. Use **Show revoked keys** to include revoked entries in the list.

Expired keys cannot authenticate. Create a replacement before the expiration shown in the console. Removing the owner's workspace membership also removes their key's access to that workspace.

## If key management is unavailable

| Message or symptom | Next step |
| - | - |
| Your account needs Agent Builder API access | Ask your Labs administrator to enable Agent Builder API access, then sign in again. |
| Labs has not allowed this key operation | Ask your Labs administrator to verify the account's key-management permissions and service policy. Workspace ownership alone does not grant these permissions. |
| Your session expired | Sign in again, then refresh the key list. |
| Creation or rotation returned an uncertain error | Refresh the list before retrying; the operation may already have completed. |

Continue with the [REST quickstart](https://docs.agents.labs.bandwidth.com/developer/quickstart.md). These keys authenticate supported REST operations; [MCP uses OAuth](https://docs.agents.labs.bandwidth.com/mcp/authentication.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.