> ## Documentation Index
> Fetch the complete documentation index at: https://docs.struct.to/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Generate and manage API keys for authenticating with Struct APIs.

API keys are used to authenticate every request to the Struct API. Each key is scoped to an [organisation](/dashboard/organisations) and inherits its plan's rate limits and credit allowance.

## Creating an API Key

<Steps>
  <Step title="Open API Keys">
    Navigate to the **API Keys** section in your organisation's dashboard.
  </Step>

  <Step title="Generate a key">
    Click **Create Key**, give it a descriptive name (e.g. `production`, `staging`), and confirm.
  </Step>

  <Step title="Copy your key">
    Your full API key is shown once at creation. Copy it and store it somewhere secure.
  </Step>
</Steps>

<Warning>API keys are only displayed in full once. If you lose a key, you'll need to revoke it and create a new one.</Warning>

## Using Your API Key

Include your API key in the `X-API-Key` header on every request.

<CodeGroup>
  ```bash cURL theme={null}
  curl https://api.struct.to/v1/polymarket/market \
    -H "X-API-Key: YOUR_API_KEY"
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch("https://api.struct.to/v1/polymarket/market", {
    headers: {
      "X-API-Key": "YOUR_API_KEY",
    },
  });
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      "https://api.struct.to/v1/polymarket/market",
      headers={"X-API-Key": "YOUR_API_KEY"},
  )
  ```
</CodeGroup>

## Managing Keys

From the API Keys page you can:

* **Rename** a key to keep your list organised
* **Revoke** a key to immediately disable it. Any requests using that key will return `401 Unauthorized`

<Note>There is no limit on the number of API keys per organisation. Use separate keys for different environments or services so you can revoke them independently.</Note>

## Security Best Practices

* Never expose API keys in client-side code or public repositories
* Use environment variables or a secrets manager to store keys
* Rotate keys periodically by creating a new key, migrating your services, then revoking the old one
* Use separate keys for production and development