# Authenticate with an API key

Create a Pristo API key for a program under Management, then send it in the X-API-Key header with every request you make to the Pristo API.

The Pristo API identifies your system by an API key that you send in the `X-API-Key` header of every request. You create the key in the Pristo CX app under **Management** > **API keys**, and it belongs to the program that is selected when you create it.

## Before you start

- Role: you are an **Account admin** or a **Program admin** of the program. See [roles and permissions](https://docs.pristo.io/cx/users/roles-and-permissions).
- Plan: Standard or Pro. **API keys** doesn't appear on the Free plan.
- Program: switch to the program the key is for by selecting the program name in the header, as in [navigate the app](https://docs.pristo.io/cx/get-started/navigate-the-app). Events you send with the key go to this program's population. See the [glossary](https://docs.pristo.io/cx/glossary).

## Steps

![Sketch of the page that lists the program's API keys. Marker 1 is on the management tab in the main menu, marker 2 on the item for API keys in the side menu, and marker 3 on the button that adds a key, at the top right. Each row shows the key's name, the first characters of the key, whether it is active and when it was created, with a menu at the end of the row.](https://docs.pristo.io/_astro/api-keys.43EVIppy.webp)

1. Select **Management** in the main menu.

2. Select **API keys**.

3. Select **Add**.

4. Enter a name in **Name** that says which system uses the key, for example `Example Coffee CRM`.

5. Select **Create**.

6. Select **Copy code** and store the key in your system's secret store.

7. Close the dialog.

> **Caution**
>
> The app shows the full key only once, with the message **Copy your key, it cannot be seen again!** Pristo CX keeps only a hash of it. If you lose the key, create a new one.

## Result

The key appears in the list with its **Name**, the first 24 characters in **Prefix**, **Active** set to **Yes**, and its **Creation time**. A key looks like `pristo_live_pk_` followed by 32 letters and digits.

Send the key with every request:

```bash
curl -X POST "https://api.pristo.io/v1/events/send" \
  -H "X-API-Key: $PRISTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type": "purchase", "contact": {"id": "CUST-1042", "email": "dana@example.com"}}'
```

> **Danger**
>
> Keep API keys on your servers. Never put a key in a website, a mobile app or a URL, where anyone can read it.

## Manage keys

Open the menu at the end of a key's row:

- **Deactivate** stops the key. The next request that uses it gets `401 Unauthorized`.
- **Activate** turns an inactive key back on. An activated key counts toward the 10 active keys, and the account must be on the Standard or Pro plan.
- **Delete** appears only for an inactive key and removes it from the list for good.

To rename a key, select the pencil next to its name. To rotate a key, create a new one, switch your system to it, then deactivate and delete the old one.

## Limits

- Up to 10 active API keys per account, counted across all programs. Inactive keys don't count.
- A key name has 1 to 50 characters.
- The list shows only the keys of the selected program.

## Troubleshooting

**I can't find where to create a key.** If **Management** is missing from the main menu, you are a **Program user** in this program: ask an account admin or a program admin. If **Management** has no **API keys**, the account is on the Free plan.

**Every request returns 401.** The `X-API-Key` header is missing, the key is wrong, or the key was deactivated or deleted. Check the key's **Active** value in the list and the header name.

**A request returns 400 with `Value is invalid`.** The header value is shorter than 24 characters. Copy the whole key again. See [API errors](https://docs.pristo.io/cx/api/errors).

**I can't create or activate a key.** The account already has 10 active keys, or it is on the Free plan, which has no API access. Use **Deactivate** on a key you no longer need, or ask an account admin to upgrade the plan.

## Related

- [Pristo API overview](https://docs.pristo.io/cx/api)
- [Send an event](https://docs.pristo.io/cx/api/send-an-event)
- [Generate a survey link](https://docs.pristo.io/cx/api/generate-a-survey-link)
- [API errors](https://docs.pristo.io/cx/api/errors)