> ## Documentation Index > Fetch the complete documentation index at: https://docs.tryhikoo.com/llms.txt > Use this file to discover all available pages before exploring further. # API keys > Create and manage keys that authenticate the Hikoo REST API and MCP server. API keys authenticate the Hikoo public REST API and the Hikoo MCP server. A key proves who you are so those interfaces can read the data you have access to. ## How a key is scoped A key is scoped to your user account. One key can reach every website in the workspaces you belong to, subject to each site's subscription. This replaces the older per-website key model, so you no longer need a separate key for each site. Access still follows subscriptions. A key can address a site only when that site has an active subscription. ## Create a key Open Settings, then the API keys section. Give it a descriptive name so you can tell your keys apart later. Add an expiry date if you want the key to stop working automatically, or leave it open. The full key is shown only once and starts with `hk_`. Copy it immediately and store it somewhere safe. If you lose it, create a new one. ## Manage keys From the API keys section you can list your keys and see their names and status. Revoke or delete a key to disable it immediately. Any client using that key stops working at once, so rotate before you revoke if a client still needs access. ## Install cards The API keys section also gives you two install cards: Get the steps to connect an AI client to your data. Get the steps to call the Hikoo REST API directly. ## Keep keys safe Treat keys like passwords. Never commit them to source control or paste them where others can read them. If a key leaks, rotate it: create a new key, update your clients, then revoke the old one. ## Related pages Wire a key into an AI client. See the tools the MCP server exposes. Where the API keys section lives.