> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rockapi.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Secure API key management

> Learn API key management practices for buyers, including scoped keys, rotation, environment separation, and production access reviews.

# Secure API key management

API keys are production credentials. Treat them like access to customer data, billing activity, and application availability.

## Key management basics

* Use separate keys for development, staging, and production.
* Do not share one key across unrelated applications.
* Store keys outside source code.
* Rotate keys after incidents, team changes, or vendor changes.
* Remove keys that no longer have an owner.

## Access review process

Create a recurring review for API keys and subscriptions. Each key should have an owner, purpose, environment, and last-reviewed date. If a key has no owner, disable it and watch for failed traffic before deleting it.

## Rock API security path

Start with [Authentication](/authentication), then review [Security and privacy](/security-and-privacy). For production integrations, test error handling with [Errors and rate limits](/errors-and-rate-limits).

<Card title="Read authentication docs" icon="shield-check" href="/authentication">
  Learn how to authenticate requests and keep API access controlled.
</Card>