# API keys

> Use API keys to authenticate API requests to Qualy.

Qualy authenticates your API requests using your account’s API keys. If a request doesn’t include a valid key or includes a deleted or expired key, Qualy returns an error.

You can use the Qualy Dashboard to create, view, and delete API keys.

---

## Create an API key

To create an API key:

1. Open [Qualy's Dashboard](https://dashboard.qualyhq.com)
2. Click on the Settings icon on the top-right corner.
3. Click on API keys & webhooks.
4. Enter a name in the Key name field.
5. Click Add new.
6. Save the key value.

## Delete an API key

If you delete a key, any code that uses that key can no longer make API calls. Create a new key and update the code to use it.

To delete a key:

1. Open [Qualy's Dashboard](https://dashboard.qualyhq.com)
2. Click on the Settings icon on the top-right corner.
3. Click on API keys & webhooks.
4. Find the Key you want to delete and click on Remove.

## Keep your keys safe

Anyone can use your API key to make any API call on behalf of your account, such as creating a transaction or performing other operations. Keep your keys safe by following these best practices:

- Grant access only to those who need it.
- Don’t store keys in a version control system.
- Control access to keys with a password manager or secrets management service.
- Don’t embed a key where it could be exposed to an attacker, such as in a mobile application.
- Use environment variables to store your keys.
- Encrypt your keys if you need to store in your databse.