> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage keys

> Create and manage public keys for log ingestion and secret keys for API and MCP access.

Sazabi has two kinds of keys. Use the right one for the job:

* **Public keys** — project-scoped, for **sending data in** (log ingestion via OTLP, webhooks, and the browser SDK). They can only write telemetry, so they are safe to ship in clients. Prefixed `sazabi_public_`.
* **Secret keys** — organization-scoped by default (a key can also be scoped to a single project), for **reading and writing the API** (the API, the CLI, and the MCP server). They grant full read/write access, so keep them server-side. Prefixed `sazabi_secret_`.

Sazabi has no "API keys" — a credential is either a public key or a secret key.

For sending data in, you normally use your **intake URL** (from [**Settings > Log streams**](https://app.sazabi.com/settings/log-source-providers)), which has your public key embedded in it — you rarely handle the raw public key. This page is for managing the underlying keys when you need to: viewing them, rotating, or deactivating.

## Choosing the right key

| You want to... | Use |
| - | - |
| Send logs, traces, or frontend telemetry into a project | Public key |
| Call the API, the CLI, or the MCP server | Secret key |

## Create a public key

Public keys are provisioned when you set up a log source, not created standalone.

1. Go to [**Settings > Public keys**](https://app.sazabi.com/settings/api) (project-scoped) to view and manage the keys your project already has.
2. To provision a new one, connect a log source (see [Instrument](https://docs.sazabi.com/send-data.md)); the setup flow creates the key for that source.
3. Copy a key's value where the flow shows it — it is displayed only once. Store it in your secret manager or platform environment.

There is no `sazabi public-keys create` command — bare public-key creation is intentionally not exposed; keys are provisioned through log-source setup. From the CLI you can list existing keys and manage their lifecycle (verify against [`/reference/cli`](https://docs.sazabi.com/reference/cli)):

```bash theme={"system"}
sazabi public-keys list                       # List public keys in the active project
sazabi public-keys deactivate <key-id>        # Revoke a public key
```

## Create a secret key

> [tab] Dashboard
>
> 1. Go to [**Settings > Secret keys**](https://app.sazabi.com/settings/secret-keys) (organization-scoped). You need owner or admin access.
> 2. Create a key and name it for its use, such as `ci-automation` or `mcp-server`.
> 3. Copy it immediately — the full value is shown only once.

> [tab] CLI
>
> Create and manage secret keys with the CLI (install and authenticate per [`/reference/cli`](https://docs.sazabi.com/reference/cli)).
>
> ```bash theme={"system"}
> sazabi secret-keys create "ci-automation"     # Create a secret key; its value is printed once
> sazabi secret-keys list                        # List secret keys in the organization
> sazabi secret-keys delete <key-id>             # Revoke a secret key
> ```
>
> The full key value is returned only on `create` — capture it from that output and store it in your secret manager. Pass `--expires-at <ISO timestamp>` to set an expiration.

## Rotate and revoke

Both key types can be rotated and revoked. To rotate a secret key, create a new one, move your clients to it, then revoke the old one. To rotate a public key, set up a replacement log source connection and retire the old one. Revocation is immediate: any client still using a revoked key loses access at once. Keep keys out of source control.

## Verify

1. Connect a log source to provision a **public key**, then send a test log with it (see [Instrument](https://docs.sazabi.com/send-data.md)); the log should appear in the project.
2. Create a **secret key**, then run `sazabi auth whoami` after authenticating with it — it should report your organization and project.

If a request is rejected as unauthorized, confirm you are using the right key type for the surface and that the key has not been revoked.

## Further reading

> [card] [Instrument](https://docs.sazabi.com/send-data.md)
>
> Use a public key to ingest logs.

> [card] [CLI reference](https://docs.sazabi.com/reference/cli.md)
>
> Authenticate the CLI with a secret key.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.