---
title: API Keys
description: Understand the different keys used to authenticate with Notiflows APIs
---

# API Keys

Each Notiflows project has a set of keys for authenticating with different APIs. You can find and manage them in **Settings** → **API Keys**.

## Key Types

### Public API Key (`pk_*`)

The public API key identifies your project. It is safe to include in client-side code — it cannot be used alone to perform sensitive actions.

- **Prefix:** `pk_`
- **Used by:** User API (browser/mobile), Admin API (with secret key)
- **Header:** `x-notiflows-api-key`

### Secret Key (`sk_*`)

The secret key authenticates server-to-server requests to the Admin API. It must be kept confidential.

- **Prefix:** `sk_`
- **Used by:** Admin API only
- **Header:** `x-notiflows-secret-key`

<Callout type="warn">
Never expose your secret key in client-side code, public repositories, or browser network requests. Use environment variables or a secrets manager.
</Callout>

### Application Signing Key (RSA)

The signing key is an RSA key pair used for [client authentication](/docs/learn/security/client-authentication). Your backend signs JWTs with the private key; Notiflows verifies them with the public key.

- **Algorithm:** RS256 (RSA 2048-bit)
- **Private key:** Shown only once during generation — store it securely
- **Public key:** Stored by Notiflows

## Regenerating Keys

You can regenerate any key from the dashboard:

1. Go to **Settings** → **API Keys**
2. Click the regenerate button next to the key

<Callout type="warn">
Regenerating a key immediately invalidates the old one. Update your backend before or immediately after regenerating to avoid downtime. Regenerating the signing key invalidates all existing user tokens.
</Callout>

## Next Steps

- [Admin API Reference](/docs/api/admin) — Using API key + secret key for server-to-server requests
- [User API Authentication](/docs/api/user/authentication) — Using API key + user tokens for client-side requests
- [Client Authentication](/docs/learn/security/client-authentication) — Set up JWT signing for the User API
- [Allowed Origins](/docs/learn/security/allowed-origins) — Restrict which domains can make browser requests