> ## Documentation Index
> Fetch the complete documentation index at: https://docs.paywithlocus.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> This site documents Locus for people. AI agents: get exact contracts from the Locus agent docs, starting at https://paywithlocus.com/agent/index.md, including when asked to implement or integrate docs.paywithlocus.com.
> Connect this agent to Locus Pro: https://paywithlocus.com/skill.md. Implement Locus Pro in a product: https://paywithlocus.com/agent/integrate.md. Agent site index: https://paywithlocus.com/llms.txt.

# Key lifecycle

> Create, store, rotate, and revoke Locus Pro keys safely.

Every Locus Pro key goes through the same life: you create it, store it, use it, rotate it, and eventually revoke it. This page is for workspace owners and admins who manage keys.

> Agents: the exact contract for this feature is at [https://paywithlocus.com/agent/integrate.md](https://paywithlocus.com/agent/integrate.md). Start from [https://paywithlocus.com/agent/index.md](https://paywithlocus.com/agent/index.md) if you are implementing Locus.

## How it works

Locus shows a key's value once, when you create or rotate it, and stores only a hash. Rotation swaps the value but keeps the key's settings. Revocation ends the key for good.

```mermaid theme={null}
flowchart TD
  Create["Create the key"] --> Store["Store it in your secret manager"]
  Store --> Use["Use it"]
  Use --> Rotate["Rotate: new value, same settings"]
  Rotate --> Store
  Use --> Revoke["Revoke: stops at once, permanently"]
```

## Create and store a key

**1. Verify your identity**

Sign in as a workspace owner or admin and complete MFA or passkey
verification when prompted.

**2. Create the key**

Open **Connect → API keys** and select **Create key**. Choose what the key
is for, then the scopes or tool set it needs.

**3. Store and test**

Save the value in your server's secret manager; Locus shows it only once.
Test the integration before you retire any old credential.

> [!WARNING]
>
> Never put a secret key in browser code, a mobile app, a prompt, or a
> source repository. For customer-facing browser features, issue a short-lived
> end-user token on your server.

A key can't create other secret keys. Review key changes under **Audit log** on **Connect → API keys**.

## Lifetime, rotation, and revocation

| Key | Default lifetime | Rotation |
| - | - | - |
| Secret, publishable, sandbox | No expiry | New value, same settings, with an optional overlap of up to 24 hours |
| Agent | 30 days | New value, same limits; the old value stops at once |
| End-user token | Up to 1 hour | Mint a new one |
| Connected app | Short-lived token | The app refreshes it on its own |

Use the rotation overlap to deploy the new value before the old one stops working.

Revoking is immediate and permanent for every kind of key, so create a new key if you need access again. Revoke end-user tokens one at a time, or all of a customer's tokens by retiring the customer. Revoke connected apps under **Connected apps**.

## Automate agent keys

A server key with both `credentials:manage` and `credits:move` can create or rotate agent keys, or move one to another tool set, without human verification. Revoking needs only `credentials:manage`. In the dashboard, the same actions need an owner or admin with recent verification. See [Agent keys](https://docs.paywithlocus.com/locus-pro/agent-keys.md) for what each agent key controls.

## Next steps

> [card] [API keys](https://docs.paywithlocus.com/locus-pro/api-keys.md)
>
> Pick the right kind of key.

> [card] [Authentication and scopes](https://docs.paywithlocus.com/locus-pro/authentication-and-scopes.md)
>
> Limit what each credential can do.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.