> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.openfort.io/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

# API keys

Openfort uses API keys to authenticate requests from your app and your server. Each project has three groups of keys, all managed on the [API keys](https://dashboard.openfort.io/api-keys) page of the dashboard:

| Key | Where to use it | Shown after creation |
|-----|-----------------|----------------------|
| [Project secret key](#project-secret-and-publishable-keys) (`sk_`) | Server only | No, only once |
| [Project publishable key](#project-secret-and-publishable-keys) (`pk_`) | Client code | Yes |
| [Shield secret key](#embedded-wallet-keys-shield) | Server only | Yes |
| [Shield publishable key](#embedded-wallet-keys-shield) | Client code | Yes |
| [Shield encryption share](#embedded-wallet-keys-shield) | Server only | No, only once |
| [Wallet secret](#backend-wallet-keys) | Server only | No, only once |

Test mode and live mode each have their own set of keys. See [test and live mode](#livemode-and-testing).

## Key types

### Project secret and publishable keys

Use project keys to authenticate requests to the Openfort API.

| Type | Example | When to use |
|------|---------|-------------|
| Secret | `sk_test_ypc...YZp` | **On the server side.** Store it securely, for example in an environment variable or a secrets manager. Don't expose it on a website or embed it in a mobile app. |
| Publishable | `pk_test_ZXb...aWg` | **On the client side.** Safe to include in your web or mobile app's client code, for example with `openfort-js`. |

The default secret key carries the default [scope set](https://www.openfort.io/docs/api-reference/authentication#secret-key-scopes). Create additional secret keys with narrower scopes from the dashboard.

The dashboard shows a secret key in full only once, when you create or regenerate it. If you lose it, [regenerate it](#regenerate-api-keys).

### Embedded wallet keys (Shield)

Embedded wallets store their recovery shares in Shield. After you set up your project keys, create these on the **Embedded wallets** tab with **Create keys**:

* **Shield secret key:** Authenticates your server with Shield to store your users' recovery shares.
* **Shield publishable key:** Identifies your Shield project in your web or mobile app's client code.
* **Shield encryption share:** Encrypts the recovery share when you use [automatic recovery](https://www.openfort.io/docs/configuration/recovery-methods). The dashboard shows it only once, when you create the Shield keys. Openfort doesn't store it and can't recover it.

### Backend wallet keys

Each project has one active **wallet secret**, which your server uses to control your backend wallets. The dashboard shows it only once, when you create or rotate it. To learn how the wallet secret works, see [backend wallet authentication](https://www.openfort.io/docs/products/server/authentication).

## Test and live mode

Every account has two separate environments: test mode for testnets and live mode for mainnets. Each mode has its own keys, and objects in one mode can't be used from the other. In **test mode**, transactions Openfort submits or sponsors (transaction intents, gas sponsorship, bundler, and Solana RPC) can only go to **testnet networks**.

:::warning
This restriction doesn't apply to backend wallets. A backend wallet's key is the same on every network, and `POST /v2/accounts/backend/{id}/sign` signs the payload as given without checking which network it targets. A test-mode secret key with the `accounts:sign` scope is not a safety net: don't fund test-mode backend wallets on mainnet, and protect the key as you would a live one. Use policies to restrict what a backend wallet can sign.
:::

## Get an API secret key in your dashboard

To get a project secret key for test mode:

1. Open the [API keys](https://dashboard.openfort.io/api-keys) page.
2. Under **Project keys**, click **Generate API keys** > **New secret key**, or choose **Regenerate key** from the menu next to an existing **Secret key**.
3. Copy the key from the **Save your secret key** dialog and store it securely.

## Regenerate API keys

:::warning
Regenerating or rotating a key invalidates the current key and generates a new one. This action can't be undone. Update every place that uses the old key, including webhooks and any Shield project registered with it.
:::

You can manage keys at any time on the [API keys](https://dashboard.openfort.io/api-keys) page:

* **Generate project keys:** Click **Generate API keys** under **Project keys**. Create a new key before removing the old one to avoid disrupting your integration.
* **Regenerate or delete project keys:** Open the menu next to a key and choose **Regenerate key** or **Delete key**.
* **Rotate Shield keys:** On the **Embedded wallets** tab, open the menu next to a key and choose **Rotate key**, **Rotate secret**, or **Rotate share**.
* **Rotate the wallet secret:** On the **Backend wallets** tab, click **Rotate secret**.

Rotating Shield keys and the wallet secret requires multi-factor authentication on your dashboard account.