> ## Documentation Index
> Fetch the complete documentation index at: https://docs.puffle.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Create and securely use a Puffle API key.

Use a Puffle API key to authenticate requests from your backend or agent.

## Create a key

<Steps>
  <Step title="Open API settings">
    Sign in to the [Puffle dashboard](https://app.puffle.ai/) and open **Settings → API**.
  </Step>

  <Step title="Generate the key">
    Click **Generate API key**, then copy the full key immediately. It is shown only once.
  </Step>

  <Step title="Store it securely">
    Save the key in a server-side environment variable such as `PUFFLE_API_KEY`. Never expose it in browser or mobile code.
  </Step>
</Steps>

## Authenticate a request

Send the key as a Bearer token:

```bash theme={null}
curl -H "Authorization: Bearer $PUFFLE_API_KEY" \
  "https://app.puffle.ai/api/account"
```

<Warning>
  An API key grants access to your Puffle account. Do not commit it to source control or include it in client-side code.
</Warning>

## Replace or revoke a key

Each account can have only one active key. Replacing it requires revoking the current key, generating a new one, and updating every service that uses it. Revocation takes effect immediately, so plan for a brief interruption while rotating credentials.

## MCP keys are separate

Keys for Puffle MCP are created under **Settings → API → MCP integrations**, are named and scoped per client, and begin with `pmcp_live_`. They are not interchangeable with the `pk_live_` API key on this page. See [Connect Puffle MCP](/guides/connect-puffle-mcp).