> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prophic.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create and Manage Prophic API Keys

> Generate, store, and revoke API keys that let external systems start Quick Quotes and read pipeline status on your organization's behalf.

Prophic API keys authenticate every request to the partner integrations API. Any org member can create keys for their own use; holders of the **Manage integrations** permission can list and revoke keys across the whole organization.

## Create a key

<Steps>
  <Step title="Open Account → API Keys">
    Navigate to your account settings and select the **API Keys** tab.
  </Step>

  <Step title="Add a new key">
    Give it a clear, descriptive name (for example `Salesforce production` or `Zapier staging`) and set an expiry that matches your rotation policy.
  </Step>

  <Step title="Copy the key immediately">
    The full value (`pk_...`) is shown **once**. Copy it into your secret manager right away. Once you close the dialog, only a masked form is visible.
  </Step>

  <Step title="Test the key">
    Send a request with the `X-API-Key` header to confirm it works. See [API reference](/integrations/api-reference) for endpoint details.
  </Step>
</Steps>

<Warning>
  Never put an API key in a browser URL, query string, or client-side code. Requests that pass the key as a query parameter are rejected with `400`. Keys grant full access to your organization's Quick Quotes.
</Warning>

## Use the key

Pass the key in the `X-API-Key` header on every request to `/v1/integrations/*`:

```bash theme={null}
curl -X POST "https://api.prophic.ai/v1/integrations/quotations" \
  -H "X-API-Key: pk_..." \
  -H "Content-Type: application/json" \
  -d '{"name":"Acme RFP","requirementsText":"Build a CRM with SSO"}'
```

Every request is automatically scoped to the organization that owns the key. You cannot pass a different organization ID.

## Key lifecycle

| Action            | Who can do it                        | Effect                                                 |
| ----------------- | ------------------------------------ | ------------------------------------------------------ |
| Create            | Any org member                       | New key with a plaintext `pk_...` shown once           |
| Deactivate        | Key owner or **Manage integrations** | Requests return `403` until reactivated                |
| Reactivate        | Key owner or **Manage integrations** | Key resumes working                                    |
| Revoke            | Key owner or **Manage integrations** | Key is soft-deleted; requests return `403` permanently |
| List all org keys | **Manage integrations**              | See and manage every key in the organization           |

Keys track `last_used_at` on every successful authentication, so you can spot unused keys and clean them up.

## Rate limits

Limits apply per API key:

| Scope                                            | Limit         |
| ------------------------------------------------ | ------------- |
| All `/v1/integrations/*` requests                | 60 per minute |
| `POST /v1/integrations/quotations` (start quote) | 10 per minute |

If you exceed a limit you get `HTTP 429` and a `Retry-After` header with the number of seconds to wait. Back off and retry after that interval.

<Tip>
  For high-volume integrations, create separate keys per workflow (for example one for CRM automation, one for a customer portal). This isolates rate-limit budgets and makes revocation surgical if a credential ever leaks.
</Tip>

## Best practices

* **Rotate regularly.** Set expiries that match your security policy and create replacement keys before the old ones lapse.
* **Use environment-specific keys.** Separate production and staging keys so you can revoke one without breaking the other.
* **Revoke on offboarding.** When a team member leaves or a partner integration ends, revoke their keys immediately.
* **Monitor `last_used_at`.** Delete keys that have not been used in a long time.

## Related

<CardGroup cols={2}>
  <Card title="Webhooks" icon="webhook" href="/integrations/webhooks">
    Get notified when pipeline steps finish.
  </Card>

  <Card title="Roles and Permissions" icon="users" href="/concepts/roles-and-permissions">
    Learn what **Manage integrations** grants.
  </Card>
</CardGroup>


## Related topics

- [Connect Prophic to Your CRM, Portal, or Automation](/integrations/overview.md)
- [Integrations and Webhooks REST API Reference](/integrations/api-reference.md)
- [Receive Prophic Pipeline Events with Webhooks](/integrations/webhooks.md)
- [Team, Roles & Organizations in Prophic](/setup/team-management.md)