> For the complete documentation index, see [llms.txt](https://docs.shoplift.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.shoplift.ai/api-reference/public-api-1/shoplift-api/shoplift-api-key.md).

# Shoplift API Key

### Get and manage your API key

Your API key authenticates every request to the Shoplift API. Each store has one active key, and the key grants full write access to that store's tests, audiences, and campaigns.

### Find your key

1. In the Shoplift dashboard, go to **Settings**.
2. Open the **API** tab in the top navigation.
3. Your key appears in the **API key** card, masked by default. Click the eye icon to reveal it, or the copy icon to copy it to your clipboard.

The card also shows when the key was created and when it was last used, which is useful for checking whether an integration is actually making requests.

### Use your key

Include the key as a Bearer token in the `Authorization` header of every request:

```http
Authorization: Bearer sl_live_<your-api-key>
```

Requests without a valid key return `401 Unauthorized`.

### Rotate your key

If your key may have been exposed, or as part of routine credential hygiene, rotate it:

1. On the **API** page, click **Rotate key**.
2. A new key is generated, and your old key stops working immediately.

{% hint style="danger" %}
Rotation is instant and has no grace period. The moment you rotate, every integration, script, and AI workflow using the old key will start failing with `401 Unauthorized`. Have a plan to update your integrations with the new key before you rotate, not after.&#x20;
{% endhint %}

The upside of instant invalidation: if a key leaks, rotating it cuts off access immediately.

### Keep your key secret

Your API key can create, launch, and end tests on your live store. Before you put it anywhere, think through who and what can read it:

* Anything exposed in client-side code or a public repository is effectively public.
* Files on disk, including `.env` files, are readable by any tool or process you grant access to that directory.
* When you give an AI assistant or third-party tool access to your key, you're trusting that tool with full write access to your store's testing program.

{% hint style="danger" %}
There's no undo on a leaked key. If you're unsure whether a key has been exposed, rotate it.&#x20;
{% endhint %}

### Still need help?

Contact the Shoplift support team if you have questions about your API key.