API Credentials

An inference credential authenticates calls to the public API at api.actual.inc. Current policy-scoped inference credentials use the ac_ prefix. Console Chat uses your web session instead.

Create and copy#

1. Open User > Keys.
2. Optionally enter a name for the credential.
3. Choose add.
4. Copy the full secret from the creation view and store it securely.
5. Choose done after saving it.

The full secret is available only in that creation view. After done, the list shows a safe preview rather than a recoverable secret.

Credential rollout can differ by account: some accounts still see the legacy API-key interface. Do not assume a legacy key is a current relay credential. If the required inference-credential flow is unavailable, resolve that account's access before following the public API examples.

Use the credential#

Set ACTUAL_API_KEY in your application's environment and send it as a bearer token:

Authorization: Bearer ac_your_credential_here

The public API supports model inventory and inference. Downloading and loading models uses the CLI or website, not a public model-management endpoint. See API Quickstart and API Reference.

Terminate or rotate#

Select an existing credential in the Keys list, choose Terminate, and confirm with Destroy. Keep cancels that confirmation. A destroyed credential cannot be restored.

For rotation, create and test a replacement, update the applications that use it, then terminate the old credential. A missing, invalid, or revoked credential produces an authentication failure; retrying with the same secret does not fix it.

Never commit credentials to source control or paste them into shared logs. Store them in environment variables or a secrets manager.