> ## Documentation Index
> Fetch the complete documentation index at: https://docs.staging.cope-demo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API key integrations

> Create, store, rotate, deactivate, and delete COPE public API keys safely.

# API key integrations

API key integrations let server-side vendor systems call the COPE public API for one COPE business. Each key has a mode, a public prefix, a secret shown only once, an active state, and last-used metadata.

## Lifecycle

| Action     | Guidance                                                                                                                                                 |
| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Create     | Create a named integration in the COPE dashboard and copy the secret immediately.                                                                        |
| Store      | Store the full token in a server-side secret manager. Do not expose secret keys in browsers or mobile apps.                                              |
| Rotate     | Create a replacement key, deploy it, confirm traffic, then deactivate the previous key.                                                                  |
| Deactivate | Deactivated keys stop authenticating within 60 seconds. Activate the key again to restore it.                                                            |
| Delete     | Delete keys that are no longer needed after confirming no clients use them. A deleted key stops authenticating within 60 seconds and cannot be restored. |

## Key format

New keys use the format `ck_live_<prefix>_<secret>`: a 12-character alphanumeric prefix that identifies the key and is safe to display, and a 48-character lowercase hexadecimal secret that is shown only once. Keys issued earlier in the format `cope_sk_live_<key_id>_<secret>` keep working unchanged.

## Where keys are managed

Create, activate, deactivate, and delete API keys in the COPE dashboard under **Settings → API Keys**. The full token is shown only once, when the key is created. COPE does not store it and cannot show it again.

Keys are managed only in the dashboard. The public API has no key-management endpoints, so an API key cannot create, activate, deactivate, or delete keys.