# API Credentials

An inference credential authenticates calls to the public API at `api.actual.inc`. Current policy-scoped inference credentials use the `ac_` prefix. Console Chat uses your web session instead.

## Create and copy

1. Open [User > Keys](/user/keys).
2. Optionally enter a name for the credential.
3. Choose **add**.
4. Copy the full secret from the creation view and store it securely.
5. Choose **done** after saving it.

The full secret is available only in that creation view. After **done**, the list shows a safe preview rather than a recoverable secret.

Credential rollout can differ by account: some accounts still see the legacy API-key interface. Do not assume a legacy key is a current relay credential. If the required inference-credential flow is unavailable, resolve that account's access before following the public API examples.

## Use the credential

Set `ACTUAL_API_KEY` in your application's environment and send it as a bearer token:

```http
Authorization: Bearer ac_your_credential_here
```

The public API supports model inventory and inference. Downloading and loading models uses the CLI or website, not a public model-management endpoint. See [API Quickstart](/docs/api-quickstart) and [API Reference](/docs/api-reference).

## Terminate or rotate

Select an existing credential in the Keys list, choose **Terminate**, and confirm with **Destroy**. **Keep** cancels that confirmation. A destroyed credential cannot be restored.

For rotation, create and test a replacement, update the applications that use it, then terminate the old credential. A missing, invalid, or revoked credential produces an authentication failure; retrying with the same secret does not fix it.

Never commit credentials to source control or paste them into shared logs. Store them in environment variables or a secrets manager.