# API keys

> Find and use your API key, signing secret, and publishable key.

Source: https://help.boltapp.com/getting-started/api-keys

Use this guide to copy credentials for the correct environment and publishable key for the intended division, then store each secret in the system that uses it.

## Get your keys [#get-your-keys]

1. Open the [sandbox Merchant Dashboard](https://merchant-sandbox.boltapp.com) for testing or the [production Merchant Dashboard](https://merchant.boltapp.com) for live traffic.
2. Select the division used by your integration. The selected division determines the publishable key shown under **Identifiers**.
3. Go to **Administration > API**.
4. Copy the credentials your integration needs. Store the API key and signing secret in your backend secret manager, not in client code.

**Expected result:** Your API key and signing secret come from one environment, and your publishable key identifies the intended division. Do not mix sandbox and production credentials.

## Keys [#keys]

| Key             | Purpose                                                                        | Where it runs         |
| --------------- | ------------------------------------------------------------------------------ | --------------------- |
| API key         | Authenticate outbound Bolt API calls                                           | Backend server only   |
| Signing secret  | Verify `X-Bolt-Hmac-Sha256` on inbound webhooks and Merchant Callback requests | Backend server only   |
| Publishable key | Identify your store to Bolt client SDKs and embed script                       | Browser or mobile app |

## Request headers [#request-headers]

* Send your API key in `X-API-Key` on authenticated outbound REST calls.
* Send `Content-Type: application/json` when the request has a JSON body.
* Add `X-Nonce` only when the endpoint reference requires it.

See [Authentication](/api-reference/authentication) for credential usage and check the endpoint reference before sending a request.

## API base URLs [#api-base-urls]

Use the API URL that matches your credentials. [Environments](/api-reference/environments) lists the sandbox and production API, CDN, and dashboard URLs.

## Key rotation [#key-rotation]

Rotate API keys and signing secrets on a schedule. Bolt supports rotation with no downtime.

### Prerequisites [#prerequisites]

* You can edit developer keys for the merchant account.
* Your webhook verification accepts both active and pending signatures during rotation.

If the rotation controls are not visible, ask your dashboard administrator or Customer Success Manager to confirm your access.

### Rotate signing secret [#rotate-signing-secret]

1. Go to **Administration > API**, scroll to **Signing Secret**, and click **Initiate Key Rotation**.
2. One key is **Active** and the new key is **Pending**. Both work during rotation. Validate the old key with `X-Bolt-Hmac-Sha256` and the pending key with `X-Bolt-Hmac-Sha256-Pending`.
3. After your app accepts the new secret, click **Complete Key Rotation** to activate the pending key.

**Expected result:** The new signing secret is **Active**, and webhook verification succeeds with it.

<Note>
  You can revert to the previous signing secret for up to **48 hours**. The signing secret table shows time remaining. Select **Revert Key Rotation** to roll back.
</Note>

### Rotate API keys [#rotate-api-keys]

Bolt allows up to five active API keys.

1. In **Administration > API**, select **Generate API key**.
2. Deploy the new key to your backend and confirm authenticated requests succeed.
3. Deactivate the old key.

**Expected result:** Your backend uses the new active key, and the old key no longer authorizes requests.

## Related [#related]

* [Authentication](/api-reference/authentication)
* [Environments](/api-reference/environments)
* [Verify webhooks](/api-reference/guides/verify-webhooks)