---
title: Manage your API keys and secret keys
description: "Create, rotate, revoke, and delete API keys and secret keys."
product: general
lang: en
last_updated: 2026-10-21
token_estimate: 921
---
# Manage your API keys and secret keys

Managers and Admins use the key management page to create and revoke API keys and to create and delete secret keys for a project. All changes are permanent.

> For AI agents: a documentation index is available at [/docs/llms.txt](/docs/llms.txt). Append `.md` to any page URL for markdown, or send `Accept: text/markdown`.

Use an API key to identify a project so Amplitude routes ingested data to it. Use a secret key to authenticate to server-side Analytics APIs that read or modify project data.

You can:

- Create and name multiple API keys and secret keys.
- View a log of the creator and the last action taken on the key.
- Disable API access.

## Required permissions

Your role in a project determines what you can do with that project's keys:

| Role | API keys | Secret keys |
| --- | --- | --- |
| Viewer | View (read-only) | No access |
| Member | View (read-only) | No access |
| Manager | View, generate, rotate, revoke | Generate, delete |
| Admin | View, generate, rotate, revoke | Generate, delete |

If your organization uses [project-level permissions](https://amplitude.com/docs/admin/account-management/manage-users#project-level-permissions), your role in each project applies. A user who is a Manager in one project and a Viewer in another can manage keys only in the first project. If your organization uses [role-based access controls (RBAC)](https://amplitude.com/docs/admin/account-management/role-based-access-controls-rbac), the _Manage API keys_ permission controls key access instead.

## Manage your keys

To manage your keys, follow these steps:

1. Select _Organization settings_ in the upper navigation.
2. Select _API Keys_ in the side navigation.

The project selector lists only the projects you have access to.

## API key

An API key identifies your project so Amplitude can route ingested data to it. Learn more about [API Key](https://amplitude.com/docs/apis/keys-and-tokens#api-key).

### Legacy API key

The first time you use API key management, you see the legacy API key in the _API Keys_ tab. Amplitude created this key when you created the project. You can't disable it, but you can click **Rotate** to replace the key.

### Generate an API key

To generate an API key, follow these steps:

1. Select the project you’re interested in.
2. Click **Generate API Key**.
3. Name the API key.

You can copy this API key to store or use elsewhere.

### Revoke an API key

To revoke an API key, follow these steps:

1. Select the API key.
2. Confirm that you want to revoke the key.

After you click **Revoke**, the key is permanently unusable. You still retain the API key for your records.

## Secret key (Beta)

Secret keys authenticate you to server-side Analytics APIs that read or modify project data. For more information, review [Keys and Tokens](https://amplitude.com/docs/apis/keys-and-tokens#secret-key).

### Generate a secret key

To generate a secret key, follow these steps:

1. Select the appropriate project.
2. Click **Generate Secret Key**.
3. Name the secret key and copy it into your records. Amplitude doesn't store secret keys, and there's no way to retrieve a secret key. The Key ID is a unique identifier for your secret key, but it's not the key itself.

### Delete a secret key

To delete a secret key, select the secret key you want to delete, then type “DELETE” to confirm your intent.

You can't use, see, or recover a secret key after deleting it.

## Limitations

- You can have a maximum of 50 active keys.
- While key creation is instantaneous, a revoked key can take up to 6 hours to stop working in rare cases. This applies to both legacy and non-legacy API keys.