---
title: "API Keys"
description: "Create, name, and revoke TurboPentest API keys for programmatic access from the dashboard, then use them to authenticate CI/CD and scripted pentests."
canonical: https://turbopentest.com/docs/account/api-keys
source: "TurboPentest Docs"
---

# API Keys

## Creating a key

### From the dashboard

1. Go to **Dashboard > API Keys**
2. Click **Create Key**
3. Enter a descriptive name (e.g. "CI/CD Pipeline", "Local Testing")
4. Copy the key immediately

The full key is only shown once. If you lose it, revoke the key and create a new one.

### From the API

```bash title="Terminal"
curl -X POST https://turbopentest.com/api/keys \
  -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "CI/CD Pipeline"}'
```

Response:
```json title="Response"
{
  "id": "uuid",
  "name": "CI/CD Pipeline",
  "prefix": "tp_a1b2c3d4",
  "key": "tp_a1b2c3d4e5f60718293a4b5c6d7e8f90"
}
```

## Using a key

Pass the key as a Bearer token in the `Authorization` header:

```bash title="Terminal"
curl -H "Authorization: Bearer tp_your_key_here" \
  https://turbopentest.com/api/pentests
```

## Revoking a key

```bash title="Terminal"
curl -X DELETE https://turbopentest.com/api/keys/{id} \
  -H "Authorization: Bearer $TURBOPENTEST_API_KEY"
```

Revoked keys cannot be used and will return `401 Unauthorized`.

## Security best practices

- Store keys in CI/CD secrets, not in code
- Use descriptive names so you know which key is used where
- Rotate keys periodically
- Revoke keys that are no longer in use