> ## Documentation Index
> Fetch the complete documentation index at: https://docs.uatu.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Console

> Create, secure, rotate, and monitor API keys.

Use the [uatu console](https://console.uatu.dev) to manage your organization's API
keys and members from one place.

<Card title="Open the console" icon="key" href="https://console.uatu.dev" horizontal>
  Go to console.uatu.dev
</Card>

## Create an API key

<Steps>
  <Step title="Sign in">
    Open [console.uatu.dev](https://console.uatu.dev) and sign in to your
    organization.
  </Step>

  <Step title="Open API keys">
    The **API keys** page lists your organization's keys, including their status,
    creator, creation date, and last-used time.
  </Step>

  <Step title="Create a key">
    Give the key a descriptive name, such as `checkout-production` or
    `quotes-staging`. You can also set an optional expiration date; a key without
    one does not expire automatically.
  </Step>

  <Step title="Copy and store it">
    Keys start with `uatu_live_`. Copy the new key directly into your secret manager
    or deployment environment.

    <Warning>
      The complete key is shown only once. The console stores a hash and cannot
      reveal the value later. If you lose it, revoke the key and create a new one.
    </Warning>
  </Step>
</Steps>

## Authenticate a request

Load the key from an environment variable instead of placing it directly in source
code:

```sh theme={null}
export UATU_API_KEY="uatu_live_..."
```

Send it as a bearer token when requesting a quote:

```sh theme={null}
curl -X POST https://api.uatu.dev/quotes \
  -H "Authorization: Bearer ${UATU_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "chain": "ethereum",
    "chainId": 1,
    "tokenIn": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2",
    "tokenOut": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
    "amount": "1",
    "recipientAddress": "0xYourRecipientAddress"
  }'
```

## Which endpoints need a key?

Creating an executable quote requires an API key. The catalogue is public.

| Endpoint | Authentication |
| - | - |
| `POST /quotes` | **Required** |
| `GET /blockchains` | Not required |
| `GET /blockchains/tokens` | Not required |
| `GET /blockchains/pools` | Not required |
| `GET /blockchains/dex` | Not required |

Public catalogue requests let you discover chains, tokens, DEXes, and pools before
signing up.

## Rotate or revoke a key

Rotate a key without interrupting traffic:

<Steps>
  <Step title="Create a replacement">
    Give the replacement a name that identifies the same service and environment.
  </Step>

  <Step title="Deploy the replacement">
    Update your secret manager or deployment environment and verify that requests
    are using the new key.
  </Step>

  <Step title="Check the old key">
    Wait until the old key's **Last used** value shows that traffic has moved. Allow
    at least one minute for reporting to catch up.
  </Step>

  <Step title="Revoke the old key">
    Revocation takes effect immediately. A revoked key remains in the console for
    audit history but can no longer authenticate requests.
  </Step>
</Steps>

## Keep keys safe

* Keep keys in server-side secret storage. Anything in a browser bundle or mobile
  application can be extracted.
* Use a separate key for each service and environment to limit the impact of a leak
  and make rotation or revocation more precise.
* Set an expiration date when a key is only needed temporarily.
* Revoke keys you no longer recognize or use.
* Never commit a key to version control or include it in logs and error messages.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.