# Client API keys (/docs/reseller/your-clients/client-api-keys)

> Issue, rotate, and revoke the API keys your clients use, from your reseller key, for any user in your client accounts.

A client can manage its own keys on the API page of its dashboard. You can also issue
and revoke them from your side, for any user in one of your client accounts. This is how
a client's own product calls the API without sharing your reseller key.

## Issue a key [#issue-a-key]

The secret is in this response only. Store it now, because no listing shows it again.

```http
POST /api/v1/reseller/users/api-keys

{ "user_id": 1234, "name": "n8n" }
```

```json
{
  "success": true,
  "user_id": 1234,
  "api_key_id": 88,
  "name": "n8n",
  "api_key": "..."
}
```

## Find a key id [#find-a-key-id]

```http
GET /api/v1/reseller/organizations
```

Each user's active keys are listed by `id` and `name`. The secret is never listed, so
store it when you issue it.

## Revoke a key [#revoke-a-key]

Pass the key's `api_key_id`, or `0` for the default key every account gets at signup.
The key stops working on the next request. Revoking a key that is already revoked
succeeds.

```http
POST /api/v1/reseller/users/api-keys/revoke

{ "user_id": 1234, "api_key_id": 88 }
```

## Rotate a key without downtime [#rotate-a-key-without-downtime]

1. Issue a new key.
2. Switch the client's integration to the new key.
3. Revoke the old key.

## Expiry and audit [#expiry-and-audit]

Keys do not expire. A key stops working when it is revoked, when the user's expiry date
passes, or when the user is archived.

Every issue and revoke is written to the account's audit log, with who did it and when.
You can see your own keys and your clients' keys, and every change is traceable.

  It carries the client's own permissions, not yours. It can do what that user can do in
  the client account, and nothing across your other clients.