> ## Documentation Index
> Fetch the complete documentation index at: https://docs.activeviam.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to manage API keys

> Programmatic credentials associated with a Risk Portal account, covering password or supported single sign-on creation, secure copying, and replacement or deletion within the two-key account limit

Applies to **Settings** → **API Keys** with **Generate API Key** and named key rows.

API keys authenticate applications that use Atoti Risk Services endpoints.
Each key remains associated with a Risk Portal account.
Creating a key does not grant additional report, portfolio, or market-data permissions.

## What is required before creation?

* Access to the intended Risk Portal account.
* The account password, or the supported single sign-on flow.
* A current **MFA Code** when requested.
* Fewer than two existing API keys.
* An approved secure location for the key.

These procedures cover password authentication and the supported single sign-on window.
For other identity configurations, confirm the available authentication method with the administrator.

<Warning>
  An API key is a credential.
  Keep key values out of shared documents, screenshots, source code, and support messages.
</Warning>

## How to generate a key

1. Open **Settings** → **API Keys**.
2. Select **Generate API Key**. The **Create API Key** dialog opens.
3. Enter a recognizable **API Key Name**, using at most 200 characters.
4. Enter the account password if **Password** appears.
5. Enter the current authentication code if **MFA Code** appears.
6. Select **Generate**.
7. Complete authentication in the separate window if the single sign-on flow opens.
8. Reload **API Keys** after creation finishes.

Verify that the named key appears without a loading or authentication error.
A closed dialog or authentication window alone does not confirm creation.
Check the refreshed list before retrying an uncertain request.

## How to copy an existing key

1. Open **Settings** → **API Keys**.
2. Locate the intended **Name**.
3. Select the copy icon beside that row's **Value**.
4. Store the copied value in the approved credential location.

The eye icon reveals or hides the displayed value.
Existing keys can be revealed again; key values are not restricted to a single display.
Keep the value hidden when screen sharing.

A copy notification does not guarantee that the browser allowed clipboard access.
If copying fails, check browser clipboard permissions before retrying.

API requests use the key value in the `x-api-key` header.
Use the **Atoti Risk Portal API** link on the screen to open the deployment's API documentation.
Endpoint access still depends on the associated account's permissions.

## How to replace a key used by an integration

When one slot is available, generate a replacement before removing the existing key.
Update the integration's credential and verify an authorized request with the replacement.
Then delete the previous key using the procedure below.

When both slots are occupied, identify each key's consumers before choosing a key to remove.
The page does not provide configurable key scopes or an expiration setting.

## How to delete a key

<Warning>
  Deleting a key can interrupt integrations that use it.
  Confirm the intended key and arrange any replacement before deletion.
</Warning>

1. Open **Settings** → **API Keys**.
2. Locate the intended **Name**.
3. Select **Delete** on that row.
4. Select **Yes** in **Confirm Delete**.
5. Reload **API Keys**.

Verify that the selected row is absent after the list loads without errors.
An empty list accompanied by a loading error does not confirm deletion.
If the row remains, the deletion is not confirmed.

For revocation checks, verify the affected integration separately.
The list does not establish when existing sessions or in-flight requests stop working.

## What can prevent key creation?

| Observation | Next step |
| - | - |
| **Max number of API keys reached** | Review the two existing keys and plan replacement before deleting either key. |
| A password or MFA error appears. | Check the required credential and current authentication code. |
| The single sign-on window does not open. | Check whether the browser blocked the authentication window. |
| Authentication finishes without a new row. | Reload the list and inspect errors before generating another key. |

For account authentication controls, see [Security](./security).
For access requirements, see [User permissions](../../admin-user-guide/user-permissions).