# API Keys

> Create and rotate model inference keys while keeping marketplace session credentials separate and private.

Canonical: https://theaimart.co/docs/api-keys
Updated: 2026-10-08 · Guide version: 1.1

Model API keys authorize AI inference, not app submission or dashboard administration. Use the service's current API documentation for its base URL, models and supported request features.

## Create and store a model key

1. Sign in and open [AI Models → API Keys](/Dashboard/AI-Models/API-Keys).
2. Generate a key and give it a descriptive name where offered.
3. Copy the raw key when it is created. Later list responses show a masked fingerprint rather than a usable secret.
4. Store it in your backend's environment or secrets manager. Never put it in browser JavaScript, app binaries or a public repository.

Key management uses your marketplace session:

| Method | Path | Purpose |
| --- | --- | --- |
| GET | `/api-keys` | List account keys, with masked previews |
| POST | `/api-keys/generate` | Create a key, optionally with `name` |
| POST | `/api-keys/regenerate` | Regenerate account keys |
| DELETE | `/api-keys/{key_id}` | Delete an owned key |

The optional creation body is:

```json
{"name":"server-inference"}
```

## Rotation and limitations

Where multiple keys are supported, create a replacement, update the authorized backend configuration, verify legitimate inference, then delete the retired key. The regenerate operation is an account-level operation; do not assume it rotates just one selected key or preserves the old key during migration.

There are no documented `listings:write`, `releases:write` or `finance:read` scopes in this key-management interface, and no guaranteed `tm_test_` key isolation. A model key is not a sandbox credential and may incur real usage charges. Refer to [AIx documentation](https://aix.theaimart.co/docs) for supported inference authentication.

## Troubleshooting

If a marketplace request returns unauthorized, use the session credential described in [Accounts & Authentication](/docs/accounts-and-auth), not a model key. If you lost the raw key, create a replacement; a masked preview cannot be used for inference. If a key leaks, revoke it and investigate actual usage without publishing the secret.

## Next

See [Developer Platform](/docs/dev-platform) and [Wallet & Credits](/docs/wallet-and-credits).