> ## Documentation Index
> Fetch the complete documentation index at: https://docs.averta.io/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create Averta runtime credentials, attach policies, and use them from SDK wrappers.

API keys connect your application to Averta's runtime decision API. Every SDK wrapper call uses one Averta API key, and that key determines which policy applies.

## Fast Path

1. Open the [Averta Dashboard](https://dashboard.averta.io).
2. Go to **API Keys**.
3. Create a key for the environment or agent you are integrating.
4. Attach the policy you want to enforce.
5. Copy the secret immediately.
6. Set it as `AVERTA_API_KEY` in your app.
7. Run one guarded request and confirm an event appears.

<Warning>
  The plaintext secret is shown once. If you lose it, create a new key and rotate your app configuration.
</Warning>

## Runtime Usage

```bash theme={null}
export AVERTA_API_KEY="your-averta-key"
```

Provider wrappers read this environment variable automatically. Use explicit wrapper key options only for unusual cases, such as selecting a different key for one client in the same process.

OpenAI:

<CodeGroup>
  ```typescript TypeScript theme={null}
  import OpenAI from "openai";
  import { wrapOpenAI } from "@averta-security/sdk-openai";

  let client = new OpenAI({
    apiKey: process.env.OPENAI_API_KEY!,
  });

  client = wrapOpenAI(client);
  ```

  ```python Python theme={null}
  import os

  from openai import OpenAI
  from averta_openai import wrap_openai

  client = wrap_openai(OpenAI(api_key=os.environ["OPENAI_API_KEY"]))
  ```
</CodeGroup>

Anthropic:

```typescript theme={null}
import Anthropic from "@anthropic-ai/sdk";
import { wrapAnthropic } from "@averta-security/sdk-anthropic";

let client = new Anthropic({
  apiKey: process.env.ANTHROPIC_API_KEY!,
});

client = wrapAnthropic(client);
```

## Table Fields

| Field      | Meaning                               |
| ---------- | ------------------------------------- |
| Name       | Human-readable key label.             |
| Key        | Masked key prefix for debugging.      |
| Policy     | Policy currently attached to the key. |
| Created by | User who created the key.             |
| Created at | Creation timestamp.                   |

Use names and prefixes that make Events easy to investigate. A key named `prod-support-agent` is more useful than `new key`.

## Policy Attachment

A key without a policy is not ready for normal runtime enforcement.

Attach a policy before using the key in an SDK integration. You can change the attached policy without changing application code, which is the reason policy attaches to the key instead of being hardcoded in the app.

## Recommended Key Strategy

| Boundary          | Recommendation                                                        |
| ----------------- | --------------------------------------------------------------------- |
| Production        | Separate key with a production policy.                                |
| Staging           | Separate key with a staging policy.                                   |
| Local development | Separate key if local traffic should be easy to filter.               |
| Multiple agents   | Separate keys when ownership, policy, or event investigation differs. |
| Retired apps      | Delete or rotate keys immediately.                                    |

Do not share one catch-all key across every agent. It makes event investigation harder and policy changes riskier.

## Troubleshooting

| Symptom                                  | Check                                                                            |
| ---------------------------------------- | -------------------------------------------------------------------------------- |
| SDK returns `401`                        | Averta key is missing, malformed, or revoked.                                    |
| SDK returns `403`                        | Key may not have an attached policy or may not be allowed for runtime decisions. |
| No events appear                         | Confirm the app is using this key and calling a supported wrapped method.        |
| Production traffic appears under staging | Verify deployed environment variables.                                           |
| Events are hard to correlate             | Use clearer key names and pass `requestContext`.                                 |
| A retired app still produces events      | Delete or rotate the old key.                                                    |

## Access

| Role  | Key access                     |
| ----- | ------------------------------ |
| Owner | View, create, and delete keys. |
| Admin | View, create, and delete keys. |
| User  | No API key management access.  |

Deleting a key revokes it immediately. Any integration still using that secret will stop making Averta decisions.

## Next Steps

<CardGroup cols={2}>
  <Card title="Policies" icon="sliders" href="/dashboard/policies">
    Create and tune the policy attached to this key.
  </Card>

  <Card title="Events" icon="activity" href="/dashboard/events">
    Confirm the key is producing runtime decisions.
  </Card>
</CardGroup>