> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gol.network/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys and environments

> Issue, use, rotate, and revoke GOL developer credentials.

An API key belongs to one project and one environment. It tells GOL which developer application made a request. Its scopes limit API access, but the key is never a substitute for an account owner's approval.

## Choose the smallest scope

For the current first-request flow, select `project:read`. It is enough for `GET /v1/whoami`. The schema also lists scopes for future account, mandate, action, and webhook operations. Their presence in a key or schema does not make those capabilities available.

The test environment is available in the local control plane. Live project and credential creation returns `capability_unavailable` while the release profile is inactive.

## Keep keys on the server

Send the key in the `Authorization` header from a backend service:

```text theme={null}
Authorization: Bearer <test-api-key>
```

Do not put the value in a web page, mobile bundle, URL, analytics event, issue, or repository. GOL displays the new secret once. Later views show only a hint so you can identify the key without exposing it.

## Rotate or revoke

Rotate a key when you need to replace it without an abrupt cutover. The local console supports a bounded overlap window so your server can switch to the new secret. Update your server configuration, verify a request using the new key, then let the old key expire or revoke it. Revocation immediately makes the old key unusable.

If a key may be exposed, revoke it immediately and issue a new one. Review the project's audit events to see authentication activity. See [make your first request](/get-started/first-request) for the verification call.