# Make, send and revoke an API key

> Create a key on your account page, send it in a header, and revoke it.

Developers · How-to guide · https://wxalerts.org/docs/developers/api-keys/

The endpoints this site uses stay public, with no key, for the site and anyone
who reads them politely. An API key is for software you
run yourself: a script, a dashboard, your own app. Every request it makes is
counted against your account and limited per key rather than per address, so a
NAT or a shared office does not cost you anything.

Keyed access is under the API Terms in [Terms §20 and §21](/terms/#api), as
well as everything the public endpoints are under.

## Make a key

Sign in, open [Account](/account/#api-keys), and use **Create a key**. Pick
what it can read and when it expires. Keys expire after 30 days unless you
choose a longer term or Never. The key is shown once.
Copy it then; it is stored only as a hash and nobody can show it to you again.
A lost key is revoked and replaced.

Keys look like `wx_live_` followed by 43 characters. You can hold up to ten
live keys. Use one per program, so revoking one stops only that program.

## Send it

Use the same paths as the public API, with `/v1` in front, and send the key in
a header. Both of these work. Use whichever your client can set.

```bash
curl -H "X-API-Key: wx_live_..." https://api.wxalerts.org/v1/alerts/active
curl -H "Authorization: Bearer wx_live_..." https://api.wxalerts.org/v1/alerts/active
```

**Never put a key in a URL.** A request with `?key=` or `?api_key=` on `/v1` is
refused with `400 key_in_query`, because URLs end up in logs, browser history
and Referer headers. If you sent one that way, revoke it and make a new one.

**Never put a key in a web page.** Anyone who opens the page can read it.
Browsers block calls to the API from other websites anyway (CORS allows only
wxalerts.org), so a web page of your own should fetch through a server you run,
which holds the key.

## Revoke a key

Revoke a key from the Account page. It stops working within a minute
everywhere. A key also stops working if it expires or if the account is
disabled or deleted.

The Account page shows when each key was last used and how many requests it
made in the last 30 days. The counts trail by up to a minute.

Which routes need a key, what each scope allows and what the error codes mean
are in [Authentication](/docs/developers/authentication/).