# API Keys

Every request to the Rebill API must include an API key in the `x-api-key` header. Requests without a valid key return `401 Unauthorized`.

***

## API key types

Each organization gets two keys: a secret key and a public key.

### Secret key (`sk_`)

Full server-side access — create charges, manage subscriptions, issue refunds, configure webhooks, manage customers and cards. Never expose it in client-side code, mobile apps, or public repositories.

### Public key (`pk_`)

Safe for client-side environments — browsers, mobile apps, and the [Rebill SDK](/sdk/introduction). Grants a limited subset of operations:

* **Checkout**: create SDK, hosted, and save-card sessions
* **Cards**: tokenize payment methods
* **Customers**: create customers, check existence by email
* **Subscriptions**: read status

All other resources require a secret key.

A secret key also works on any endpoint that accepts a public key. If you're building a server-side integration, the secret key is all you need.

```text {{ title: 'Secret key' }}
sk_ea1db6a164bb4fd6bb208d0b86655657
```

```text {{ title: 'Public key' }}
pk_50a6bfb37f474fa2995c32f21ee13d1c
```

***

## Get your keys

Keys are managed on [my.rebill.com](https://my.rebill.com): open **Developer Center**, then **API Keys**.

1. Click **Create API KEY** — Rebill creates a secret/public pair.
2. The **public key** stays visible in the dashboard. The **secret key** is always masked and never shown in full.

Your account includes a paired sandbox organization for testing. Switch to it from the top bar in the Dashboard to access its keys — all transactions are simulated and never charge real cards.

***

## Make an authenticated request

Pass your key in the `x-api-key` header on every call. The example below fetches your organization details — a reliable way to confirm your key is working before making other calls.

Your API key. Use `sk_` for server-side calls; `pk_` only works on public endpoints.

```json
{
  "id": "org_4f7b2c8e1a3d9f6e2b5a8c3d1e9f7b2c",
  "name": "Acme Corp",
  "alias": "acme",
  "status": "active",
  "environment": "productive"
}
```

***

## Authentication errors

| Status             | Cause                                                  |
| ------------------ | ------------------------------------------------------ |
| `401 Unauthorized` | Missing `x-api-key` header or invalid key.             |
| `401 Unauthorized` | Public key (`pk_`) used on a secret-key-only endpoint. |
| `403 Forbidden`    | Insufficient permissions for the requested operation.  |

***

## Security

**Store keys in environment variables.** Never hard-code an API key in source code. Use `.env` files locally and your platform's secrets manager in production.

```bash
# .env
REBILL_SECRET_KEY=sk_ea1db6a164bb4fd6bb208d0b86655657
```

**Rotate keys regularly.** Generate a new key, update your environment variables, then delete the old one. Both keys can coexist during the transition window.

**Revoke exposed keys immediately.** If a key appears in a log, a repo, or a screenshot — revoke it from the Dashboard and generate a fresh pair.

**Never log the full key value.** Structured logs should include at most the last four characters: `key ending in ...5657`. Enable secrets scrubbing in your APM or logging tool.

***

## Next steps

* [API Quickstart](/api/quickstart) — make your first API call in minutes
* [Going live](/guides/going-live) — checklist before switching to production keys