> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bitfab.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys

> Create and manage API keys for authenticating with Bitfab

## Overview

API keys are used to authenticate your applications with Bitfab. Each API key is scoped to an organization and can be used to:

* Call functions via the SDK
* Send traces to Bitfab
* Access the Bitfab API
* Connect coding agents via MCP (Model Context Protocol)

## Creating an API Key

1. Click your profile avatar in the top-right corner of the Bitfab web portal
2. Select **API Keys** from the dropdown menu
3. Click **Create API Key**
4. Enter a name for your API key (e.g., "Production", "Development")
5. Copy the generated API key immediately - it will only be shown once

<Warning>
  Store your API key securely. Never commit API keys to version control or expose them in client-side code.
</Warning>

## Using API Keys

### Environment Variables

The recommended way to use API keys is through environment variables:

```bash theme={null}
# .env
BITFAB_API_KEY=bf_your_api_key_here
```

### SDK Configuration

Pass your API key when initializing the SDK:

<CodeGroup>
  ```typescript TypeScript theme={null}
  import { Bitfab } from "@bitfab/sdk"

  const client = new Bitfab({
    apiKey: process.env.BITFAB_API_KEY,
  })
  ```

  ```python Python theme={null}
  from bitfab import Bitfab

  client = Bitfab(
      api_key=os.environ["BITFAB_API_KEY"]
  )
  ```
</CodeGroup>

### VS Code Extension

Configure your API key in VS Code settings:

1. Open VS Code Settings (`Cmd+,` or `Ctrl+,`)
2. Search for "Bitfab"
3. Enter your API key in the **Bitfab: Api Key** field

Or use the command palette:

1. Open Command Palette (`Cmd+Shift+P` or `Ctrl+Shift+P`)
2. Run **Bitfab: Set API Key**
3. Enter your API key

### MCP (Model Context Protocol)

For coding agents like Cursor and Claude Code, API keys are used to authenticate MCP connections:

**Claude Code**: Install the [Bitfab plugin](/mcp-setup#claude-code) - it handles authentication and MCP setup automatically via `/bitfab:setup`.

**Other agents**: Visit the [Bitfab setup page](https://bitfab.ai/setup) for automatic configuration with your API key embedded, or include your API key in the MCP configuration manually:

```json theme={null}
{
  "mcpServers": {
    "bitfab": {
      "type": "streamable-http",
      "url": "https://bitfab.ai/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}
```

See the [MCP Setup guide](/mcp-setup) for detailed instructions.

## Managing API Keys

### Viewing API Keys

Click your profile avatar and select **API Keys** to view all API keys for your organization. You can see:

* Key name
* Creation date
* Last used date
* Partial key (last 4 characters)

### Revoking API Keys

To revoke an API key:

1. Click your profile avatar and select **API Keys**
2. Find the API key you want to revoke
3. Click the **Revoke** button
4. Confirm the revocation

<Warning>
  Revoking an API key is immediate and permanent. Any applications using the revoked key will stop working.
</Warning>

## Best Practices

* **Use separate keys for different environments**: Create separate API keys for development, staging, and production
* **Rotate keys regularly**: Periodically create new keys and revoke old ones
* **Use descriptive names**: Name your keys clearly to identify their purpose
* **Monitor usage**: Check the "Last Used" date to identify unused keys

### MCP-Specific Security

When using API keys with coding agents:

* **Secure storage**: MCP configurations are stored locally on your development machine - ensure it's encrypted and secure
* **Team access**: Be cautious about sharing MCP configurations that contain API keys
* **Development vs production**: Consider using separate organizations or API keys for different environments
* **Review agent behavior**: Understand how your coding agent handles and logs API requests

<Warning>
  Some MCP clients may log requests or store configuration in plaintext. Review your agent's security practices and consider the sensitivity of your traced data.
</Warning>