# [How API keys work](https://rebilder.com/help/api-keys/how-api-keys-work)

- **Summary:** Keys start with rblr_, are shown once, and authenticate supported integrations for your own store. Learn their scope and how to rotate them.

## What a key looks like

Every store gets its own API key: the prefix `rblr_` followed by 48 random characters. The prefix makes a leaked key easy to recognize in code or logs, and easy to talk about with support.

## Create and store your API key

The full API key is displayed once when created. Rebilder stores its hash for authentication. Copy the key into your server configuration and keep it private.

## What a key can and cannot do

- Can: authenticate event reporting. The gateway sends visit events to Rebilder’s `POST /v1/events` endpoint with the key as a Bearer token, and those events fill your visit log.
- Can: report orders through the outcomes API and retrieve approved Answers Hub entries through the export API. A store key does not sign you in to the Console or change account settings.
- Cannot: write another store’s events. The store is always resolved from the key itself, never from the request body.

> Treat the key like a password anyway: store it in environment variables or a password manager, never in shared documents or client-side code.