---
title: How API keys work
description: Keys start with rblr_, are shown once, and authenticate supported integrations for your own site. Learn their scope and how to rotate them.
canonical_url: https://rebilder.com/help/api-keys/how-api-keys-work
---

# [How API keys work](https://rebilder.com/help/api-keys/how-api-keys-work)

- **Summary:** Keys start with rblr_, are shown once, and authenticate supported integrations for your own site. Learn their scope and how to rotate them.

## What a key looks like

Every site gets its own API key: the prefix `rblr_` followed by 48 random characters. The prefix makes a leaked key easy to recognize in code or logs, and easy to talk about with support.

## Create and store your API key

The full API key is displayed once when created. Rebilder stores its hash for authentication. Copy the key into your server configuration and keep it private.

## What a key can and cannot do

- Can: authenticate event reporting. The gateway sends visit events to Rebilder’s `POST /v1/events` endpoint with the key as a Bearer token, and those events fill AI visits in the Console.
- Can: report orders through the outcomes API and retrieve approved Answers Hub entries through the export API. A site key does not sign you in to the Console or change account settings.
- Cannot: write another site’s events. The site is always resolved from the key itself, never from the request body.

> Treat the key like a password anyway: store it in environment variables or a password manager, never in shared documents or client-side code.