> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qontext.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Create and rotate workspace API keys, authenticate requests, and configure access controls.

Authenticate with an API key from the workspace you want to access. Use the same key for every request in a workflow.

```bash theme={null}
curl --fail-with-body https://api.qontext.ai/v1/files \
  -H "Authorization: Bearer $QONTEXT_API_KEY"
```

`X-API-Key` is also supported. Send one authentication header: if both are present, `X-API-Key` takes precedence, even when its value is invalid.

## Workspace access

The key determines the workspace and the files and folders the client can access. Configure its **Access Controls** in the app; see [Access management](/features/access-management#access-controls-for-api-keys).

Keys inherit their creator’s permissions by default. A key inheriting an owner’s or admin’s permissions can change file protection. Permissions assigned directly to a key are limited to **Can read** or **Can edit**; those grants do not allow changing protection.

Use separate keys for each application or environment. Keep secrets in environment variables or a secret manager, outside source code and browser applications.

## Creating an API key

<Steps>
  <Step title="Go to Clients">
    In the [Qontext app](https://app.qontext.ai), go to **Clients → API Keys**. To add an API key, click **+ Create API key** in the top right corner.

    <img src="https://mintcdn.com/qontext/ij80IpzZhIk9hRMP/images/Qontext_add-API-key.png?fit=max&auto=format&n=ij80IpzZhIk9hRMP&q=85&s=6e5df589299ffdb59464e67720d36486" alt="Qontext Add API Key" title="Qontext Add API Key" style={{ width:"91%" }} width="1286" height="357" data-path="images/Qontext_add-API-key.png" />
  </Step>

  <Step title="Create API key">
    In the **Create an API key** window, give your key a name and add an expiration date if required.

    <img src="https://mintcdn.com/qontext/ij80IpzZhIk9hRMP/images/Qontext_API-key-creation-1.png?fit=max&auto=format&n=ij80IpzZhIk9hRMP&q=85&s=845966d318c52ac5ea1d6651435bf0be" alt="Qontext API key creation" title="Qontext API key creation" style={{ width:"44%" }} width="520" height="538" data-path="images/Qontext_API-key-creation-1.png" />
  </Step>

  <Step title="Copy API key">
    Copy the API key and store it safely. You will not be able to view it again later.
  </Step>

  <Step title="Access Qontext">
    You can now access the context repository from any application, workflow, or script by sending `Authorization: Bearer <your-api-key>` with API requests.
  </Step>
</Steps>

## Rotating an API key

Rotate a key to replace its secret while keeping the key itself in place. Rotate when a secret may have been exposed, when it was shared more widely than intended, or on a regular schedule as part of your security practices. Owners, admins, and the member who created the key can rotate it.

<Info>
  The current secret stops working immediately. There is no overlap period, so any client still using the old secret fails until you update it with the new one.
</Info>

<Steps>
  <Step title="Open the API key">
    In the [Qontext app](https://app.qontext.ai), go to **Clients → API Keys**. Click the three dots next to the key and choose **Rotate**, or open the key and select **Rotate** in the **Danger zone**.

    <img src="https://mintcdn.com/qontext/IfIOs9VxPbtbBrIo/images/Qontext_rotate-API-key.png?fit=max&auto=format&n=IfIOs9VxPbtbBrIo&q=85&s=82f8f91f7400fdee820dc5d76165f98a" alt="Qontext Rotate API Key" title="Qontext Rotate API Key" style={{ width:"91%" }} width="1400" height="843" data-path="images/Qontext_rotate-API-key.png" />
  </Step>

  <Step title="Confirm the rotation">
    Check that you are rotating the right key, then select **Rotate key**.
  </Step>

  <Step title="Copy the new API key">
    Copy the new API key and store it safely. You will not be able to view it again later.
  </Step>

  <Step title="Update the client">
    Replace the old secret wherever the key is used and send it using `Authorization: Bearer <your-api-key>`. Send a request to confirm the client works again.
  </Step>
</Steps>

### What stays the same

Rotation keeps the key's name, access controls, expiration date, and retrieval logs. It does not extend the expiration date; replace an expired key with a new one.