---
agentTools:
  projectIndex: https://developers.burodeingresos.com/llms.txt
---

# 🔑 API keys: one kind of key, multiple active, zero-downtime rotation

<br />

* **New** — up to **5 active API keys** per account, created and revoked self-serve from the Console, with zero-downtime rotation and a dedicated `revoked_api_key` error when a revoked key is used.
* **Changed** — the fixed **public key / private key** pair is gone. Every API key is now the same kind of key.

## ⚙️ What Changes

### One kind of API key

Your account used to have two fixed credentials in the Console: a public key and a private key. That distinction no longer exists. There is now a single list of API keys, all of the same kind — you create them, label them, and revoke them yourself, and they all authenticate the same way with the `X-API-Key` header.

The keys you already use keep working and appear in that list, so there is nothing to change in your integration. If one of them is a key you no longer use, revoke it.

### Multiple active keys and zero-downtime rotation

You can keep up to 5 API keys active at the same time and manage them from **Developers → API keys**: create a key with a label, see when it was last used, and revoke it when you no longer need it.

To rotate without interruption: create the new key, deploy it, confirm in *Last used* that the previous key stopped receiving traffic, and then revoke it. The secret is shown only once, at creation — store it immediately, it cannot be retrieved later.

A revoked key stops authenticating immediately and returns `revoked_api_key`, which is distinct from an invalid key. At least one active key is required at all times, so the last remaining active key cannot be revoked.

[Rotation guide →](https://developers.burodeingresos.com/docs/authentication#api-keys-rotation-zero-downtime)