> ## Documentation Index
> Fetch the complete documentation index at: https://docs.signupbear.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage API keys

> Create, store, rotate, and revoke test and live keys.

SignupBear has two key environments:

| Prefix     | Environment | Use                                |
| ---------- | ----------- | ---------------------------------- |
| `sg_test_` | Test        | Staging and deterministic fixtures |
| `sg_live_` | Live        | Production signup traffic          |

## Store keys safely

* Keep keys in a server-side secret manager.
* Never commit keys to source control.
* Never expose keys through `NEXT_PUBLIC_` or another browser-visible variable.
* Never write the full `Authorization` header to logs.

The raw key is shown once. SignupBear stores only a SHA-256 hash for
authentication and a short prefix for identification.

## Rotate a key

1. Create a replacement key in the same environment.
2. Add it to your deployment secret manager.
3. Deploy and verify a test request.
4. Revoke the old key in **Dashboard > API keys**.

<Warning>
  Revocation takes effect on the next request and cannot be undone. Keep the old
  key active until the replacement deployment is verified.
</Warning>