> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.openfort.io/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

# API keys

## Livemode and testing

Every account is divided into two universes: one for testnet, and one for mainnet. All requests exist in one of those two universes, and objects in one universe cannot be manipulated by objects in the other. In **test mode**, transactions Openfort submits or sponsors (transaction intents, gas sponsorship, bundler and Solana RPC) can only go to **testnet networks**.

This does not apply to backend wallets. A backend wallet's key is the same on every network, and `POST /v2/accounts/backend/{id}/sign` signs the payload as given without checking which network it targets. A test-mode secret key with the `accounts:sign` scope is not a safety net: do not fund test-mode backend wallets on mainnet, and protect the key as you would a live one. Use policies to restrict what a backend wallet may sign.

## API keys

Authenticate your requests to access any of the endpoints in the Openfort API. API keys are used to authenticate these requests.

### Project secret and publishable keys

All accounts have a total of four API keys by default—two for test mode and two for live mode:

1. **Test project secret key:** Use this key to authenticate requests on your server when in test mode. It carries the default [scope set](https://www.openfort.io/docs/api-reference/authentication#secret-key-scopes); create additional keys with narrower scopes from the dashboard.
2. **Test project publishable key:** Use this key for testing purposes in your web or mobile app's client-side code.
3. **Live project secret key:** Use this key to authenticate requests on your server when in live mode. It carries the default [scope set](https://www.openfort.io/docs/api-reference/authentication#secret-key-scopes); create additional keys with narrower scopes from the dashboard.
4. **Live project publishable key:** Use this key, when you're ready to launch your app, in your web or mobile app's client-side code.

| Type        | Value                | When to use |
|-------------|----------------------|-------------|
| Secret      | `sk_test_ypc...YZp`  | **On the server-side**: Must be secret and stored securely in your web or mobile app's server-side code (such as in an environment variable or credential management system) to call Openfort APIs. Don't expose this key on a website or embed it in a mobile application. |
| Publishable | `pk_test_ZXb...aWg`  | **On the client-side**: Can be publicly-accessible in your web or mobile app's client-side code (such as `openfort-js`). |

### Embedded wallet keys (Shield)

All accounts have a total of three API keys by default for Shield functionality:

1. **Shield secret key:** Use this key to store the recovery share of your users on server.
2. **Shield publishable key:** Use this key, when you're ready to launch your app, in your web or mobile app's client-side code.
3. **Shield encryption share key:** Only used whenever you're using the [automatic recovery](https://www.openfort.io/docs/configuration/recovery-methods) to encrypt the recovery share.

### Backend wallet keys

All accounts have one active **wallet secret** that needs to be used in order to control your backend wallets.
To learn more about how the wallet secret works, head to [backend wallet authentication](https://www.openfort.io/docs/products/server/authentication).

## Get an API secret key in your dashboard

Openfort APIs use your secret key to authenticate requests from your server. The dashboard shows a secret key only once, when you create or regenerate it. To get an API secret key for test mode:

1. Open the [API keys](https://dashboard.openfort.io/api-keys) page.
2. Under **Project keys**, click **Generate API keys** > **New secret key**, or choose **Regenerate key** from the menu next to an existing **Secret key**.
3. Copy the key from the **Save your secret key** dialog and store it securely.

## Regenerate API keys

:::warning
Regenerating an API key will invalidate the current key and generate a new one. This action cannot be undone. If you have set up webhooks or registered a Shield project with the key, you will need to update them with the new key.
:::

Openfort supports the ability to regenerate, delete and create API keys. You can do this at any time in the [API keys](https://dashboard.openfort.io/api-keys) section of the dashboard.

* **Delete and regenerate API keys**: Open the menu next to a key and choose **Regenerate key** or **Delete key**.
* **Generate new API keys**: Click **Generate API keys** under **Project keys**. You can create multiple API keys when you're planning to generate a new one to avoid disruption to your integration.