> For the complete documentation index, see [llms.txt](https://developer.paddle.com/llms.txt).
>
> To search these docs, send a `GET` request to `https://paddle-docs-retrieval.kapa-paddle.workers.dev/?q=<question>` with a URL-encoded question. No authentication needed. It returns a JSON array of `{content, source_url}`, most relevant first.

# API keys

API key entities hold the details of the keys that authenticate requests to the Paddle API from your backend.

---

API keys [authenticate requests to the Paddle API](https://developer.paddle.com/api-reference/about/authentication.md) from your backend. You create them in the Paddle dashboard, assign [permissions](https://developer.paddle.com/api-reference/about/permissions.md) to limit what they can do, and set an expiry date so they don't live forever.

API key entities hold information like:

- The name and description of the key, so you can tell where it's used.
- Its status: `active`, `expired`, or `revoked`.
- The [permissions](https://developer.paddle.com/api-reference/about/permissions.md) assigned to the key.
- When the key expires, when it was last used, and whether it has been [exposed](https://developer.paddle.com/api-reference/about/authentication.md#secret-scanning).
- Whether the key is [rotatable](https://developer.paddle.com/api-reference/about/authentication.md#rotatable).
- An obfuscated version of the key, like `pdl_live_apikey_01jkdpbhaz****`. The full key is only shown once, when you create it.

Listing API keys, and getting any key other than your own, requires the `api_key.read` permission. Legacy API keys, created before May 6, 2025, don't have permissions. They're returned with `permissions: null`, and their obfuscated `key` doesn't have the `pdl_` prefix.

[Rotatable keys](https://developer.paddle.com/api-reference/about/authentication.md#rotatable) can also be rotated using the API. A rotation replaces the secret of a key while the key keeps its ID, name, and permissions. Paddle returns the new secret once, when you [create the rotation](https://developer.paddle.com/api-reference/api-keys/create-api-key-rotation.md), and the old secret keeps working for a grace period that you set when you create the rotation. The grace period starts when the new secret is first used. Rotation operations don't require a permission, but a key can only rotate itself. See [Rotate with the Paddle API](https://developer.paddle.com/api-reference/about/rotate-api-keys.md#rotate-with-api).

{% callout type="info" %}
You can't create, update, or revoke API keys using the API. Manage them in **Paddle > My account > Settings > Authentication**. See [Manage API keys](https://developer.paddle.com/api-reference/about/authentication.md).
{% /callout %}